“eSIM” often gets treated as a single technology, but the GSMA defines three main remote SIM provisioning standards, each built for a different kind of device. Each one also comes with companion documents covering architecture, testing, and security. SGP.02 covers machine-to-machine (M2M) devices. SGP.22 covers consumer devices like phones and smartwatches. SGP.32 is the newest and is designed specifically for IoT. For integrators choosing a SIM approach for connected devices, knowing which standard a product follows matters. It shapes how profiles are managed, who controls carrier changes, and how a deployment can adapt over its lifetime.
eSIM, eUICC, and iSIM: Getting the Terms Right
These three terms are often used interchangeably, but they describe different things. “eSIM” is the everyday name for a SIM that can be provisioned remotely. The eUICC (embedded Universal Integrated Circuit Card) is the technology underneath it, the secure element and software that store carrier profiles and accept new ones over the air.
An eUICC can take several physical forms. It can sit on a removable plastic SIM card, on a chip soldered directly to the circuit board, or inside the device’s main chipset as an integrated SIM (iSIM). The GSMA maintains separate security specifications for integrated eUICCs [1].
None of these terms say which provisioning standard a device follows. An eUICC can support SGP.02, SGP.22, or SGP.32, and the presence of an eUICC alone does not mean a device supports SGP.32. Form factor and provisioning standard are separate decisions, and both belong in a SIM evaluation.
Three Specifications, Three Different Problems
All three standards do the same basic job. They let an embedded UICC (eUICC) receive and switch carrier profiles over the air instead of requiring a physical SIM swap. What separates them is who starts a profile change, how the command reaches the device, and what the device needs to support it.
SGP.02: eSIM for M2M
The GSMA published its embedded SIM specification for M2M in December 2013 to enable remote, over-the-air provisioning and management of SIMs in machine-to-machine devices [4]. SGP.02 uses a “push” model. Two server roles do the work. The SM-DP (Subscription Manager Data Preparation) prepares carrier profiles. The SM-SR (Subscription Manager Secure Routing) securely delivers commands to the eUICC and manages it.
The model was built around the mobile operator. Each eUICC is tied to an SM-SR, and moving to a new operator requires integration between the parties’ subscription management platforms or a formal handover of the eUICC from one SM-SR to another. For large, operator-led programs like connected vehicles, that model works. For smaller deployments, or for anyone who wants to change carriers on their own timeline, it adds integration work and slows things down.
SGP.02 is still an active GSMA specification. The GSMA lists several versions as active, with v4.3 published in January 2023 [2].
SGP.22: eSIM for Consumer Devices
The GSMA released its consumer remote provisioning specification in February 2016. It was designed to let consumers remotely activate the SIM embedded in devices such as smartwatches, fitness bands, and tablets [5]. SGP.22 reverses the SGP.02 model to a “pull” approach. The user starts a profile download, usually by scanning a QR code or entering an activation code. A Local Profile Assistant (LPA) on the device handles the request, and the operator’s SM-DP+ server delivers the profile.
SGP.22 is the standard behind eSIM in nearly every modern smartphone, and the GSMA continues to update it, most recently with v2.7 in April 2026 [1]. The limitation for IoT is the user. Consumer eSIM assumes a person is present to approve a download, and a sensor bolted to a pipeline or a tracker inside a shipping container has no screen and no user.
SGP.32: eSIM Built for IoT
SGP.32, together with its companion architecture document SGP.31, fills the gap between the two earlier standards. The GSMA scopes it to IoT devices that are network constrained, user-interface constrained, or both [6]. SGP.31 v1.0 was published in April 2022. SGP.32 v1.0 followed in May 2023 [13]. Since then the GSMA has released v1.1 and v1.2 in 2024 and v1.3 in May 2026, and v1.2 and v1.3 are the active versions today [1].
SGP.32 keeps the SM-DP+ infrastructure from the consumer standard, so operators issue IoT profiles from the same systems they already use. What changes is how downloads and profile changes are triggered. The GSMA splits the consumer LPA into two parts [3]. The eSIM IoT Remote Manager (eIM) is a server-side component that triggers profile downloads and enables, disables, and deletes profiles across many devices at once. The IoT Profile Assistant (IPA) sits on the device or inside the eUICC and carries out those instructions, so no user interaction is needed [3].
| SGP.02 (M2M) | SGP.22 (Consumer) | SGP.32 (IoT) | |
|---|---|---|---|
| First published | 2013 | 2016 | 2023 (SGP.31 in 2022) |
| Provisioning model | Server push via SM-SR | User-initiated pull via LPA | Remote trigger from eIM, executed by IPA |
| Key components | SM-DP, SM-SR, eUICC | SM-DP+, LPA, SM-DS, eUICC | SM-DP+, eIM, IPA, eUICC |
| Who controls profile changes | Operator or SM-SR owner | End user | Whoever operates the eIM |
| User interface required | No | Yes | No |
| Built for constrained networks | Limited | No | Yes |
| Typical use | Connected cars, legacy M2M | Phones, wearables, tablets | Meters, trackers, sensors, industrial equipment |
The Real Shift: Who Controls the Profiles
The biggest practical difference between SGP.02 and SGP.32 is who holds control of the eUICC. Under SGP.02, the operator or its subscription management provider manages the eUICC, and any change of operator runs through that relationship. Under SGP.32, control sits with whoever operates the eIM. The GSMA notes that an IoT OEM may run an eIM to manage its own devices [3], and the role can also sit with an enterprise or a connectivity provider. Operators still supply the profiles themselves from their SM-DP+ servers, which the Trusted Connectivity Alliance notes must always be certified under the GSMA Security Accreditation Scheme (SAS) [8].
The reason this matters is scale. Juniper Research notes that provisioning thousands of devices one at a time through a pull model is inefficient, and that enterprises need centralized, server-driven control [10]. Bulk activation, lower operating costs, and the flexibility to change providers are the benefits Juniper points to [11].
What SGP.32 Changes for Integrators
Three practical points stand out for teams selecting SIM technology for their devices.
The first is network fit. SGP.02 depends on SMS to wake the eUICC, which is a poor match for some low-power networks such as NB-IoT. SGP.32 is IP-based and was designed with LTE-M, NB-IoT, and other constrained connections in mind. It supports lighter transport options suited to low-power devices alongside standard HTTPS for broadband devices [7][8].
The second is where the IPA lives. When the IPA runs inside the eUICC, the SIM handles most of the work, which reduces the development effort on the device side. When the IPA runs in the device itself, the device maker takes on more of the integration. Each approach affects device certification and should be confirmed early with module and SIM suppliers.
The third is certification. The SGP.32 ecosystem has several separately certified pieces. These are the eUICC, the device and its IPA, and the eIM, each tested against the GSMA SGP.33 test specifications and covered by the GSMA compliance and security accreditation programs [1]. “SGP.32 certified” on a datasheet is a starting point, not an answer. The questions that matter are which component the certification covers and which version of the spec it was tested against.
Where the Market Stands in 2026
SGP.32 has moved from specification to commercial availability over the last two years. The GSMA’s SGP.33 test specifications have been active since early 2025, certified eUICCs and eIM platforms reached the market during 2025, and operator SGP.32 offerings began launching in the first half of 2026. Transforma Insights refers to 2026 as the year of final commercial availability for the standard [9].
The long-term forecasts point clearly toward SGP.32. Transforma Insights projects that remote SIM provisioning capability will be present in 57% of cellular IoT shipments by 2035, up from 19% at the end of 2025. It expects SGP.32 to become the dominant provisioning standard in 2027 and to account for 53% of all cellular IoT shipments by 2035, while SGP.02 falls to about 1% [9]. Juniper Research expects devices using eSIM to grow from 1.2 billion in 2025 to 1.5 billion in 2026 [10]. ABI Research forecasts more than 633 million eSIM-enabled device shipments in 2026 [12]. Forecasts show where the market is heading. They do not change what a device shipping next quarter needs in order to work.
Analysts are also clear that the standard alone does not make a connectivity strategy. Matt Hatton of Transforma Insights put it directly: “SGP.32 is just a tool… But it is not a substitute for a well-rounded and effective connectivity proposition” [9]. Coverage, carrier agreements, rate plans, and support still decide how well a deployment performs.
What About Existing SGP.02 Deployments?
SGP.02 is not going away anytime soon. The GSMA continues to list SGP.02 versions as active and to maintain its M2M test and compliance documents [2]. Transforma Insights expects a persisting installed base of SGP.02 devices, particularly in vehicles [9].
For most deployments, moving to SGP.32 happens at a hardware refresh rather than through an over-the-air update, because the eUICC itself has to support the IoT architecture. Devices already in the field keep working as they are. Planning for SGP.32 starts with the next device generation.
Where Multi-IMSI Fits
Multi-IMSI is a separate approach that often comes up in the same conversations. A multi-IMSI SIM stores several carrier identities on a single SIM and switches between them using an applet, without downloading a new profile. It is not a GSMA remote provisioning standard. It works in standard SIM form factors today and switches networks quickly because the identities are already on the card. The two approaches are not mutually exclusive, and multi-IMSI applets can run on eUICC hardware. Many integrators evaluate both based on device lifespan, deployment regions, and how much control they want over profile changes.
Questions to Ask When Evaluating IoT eSIM Options
A few questions help clarify which approach fits a given device and deployment.
- Which GSMA specification does the SIM support, and which version?
- Is the IPA in the eUICC or in the device, and what does that mean for device certification?
- Who operates the eIM, and can it be changed later?
- Which operator profiles are available in the regions where devices will be deployed?
- What is the plan for devices already in the field on SGP.02 or traditional SIMs?
The Bottom Line
SGP.02, SGP.22, and SGP.32 solve three different problems. SGP.02 built the foundation for operator-managed M2M connectivity. SGP.22 made eSIM work for consumers. SGP.32 brings remote provisioning to headless, low-power, and large-scale IoT deployments, and it shifts profile control toward the organizations that deploy the devices. For new IoT designs, SGP.32 is worth understanding now. Like any standard, though, it is one piece of the decision. Coverage, carrier relationships, and support still determine how a deployment performs in the field. Datablaze continues to follow SGP.32 closely as the ecosystem matures.
Frequently Asked Questions
What is the difference between SGP.02, SGP.22, and SGP.32?
All three are GSMA specifications for remote SIM provisioning. SGP.02 is built for M2M devices and uses an operator-controlled push model. SGP.22 is built for consumer devices and relies on the user to start a profile download. SGP.32 is built for IoT devices that have limited network resources or no user interface, and it uses a remote manager (the eIM) to trigger profile changes across a fleet.
What is SGP.32?
SGP.32 is the GSMA’s technical specification for eSIM in IoT devices, paired with the SGP.31 architecture and requirements document. It was first published in 2023, and the current version is v1.3, released in May 2026 [1].
Is SGP.02 being phased out?
Not officially. The GSMA still lists several SGP.02 versions as active and continues to maintain its M2M test and compliance documents [2]. Analysts expect its share of new shipments to shrink sharply as SGP.32 adoption grows, with Transforma Insights projecting SGP.02 at about 1% of cellular IoT shipments by 2035 [9].
Can an existing SGP.02 device be upgraded to SGP.32?
In most cases, no. The eUICC itself has to support the SGP.32 architecture, so moving to SGP.32 usually happens when devices are redesigned or replaced. Existing SGP.02 devices typically continue operating under SGP.02.
Does SGP.32 require a user interface on the device?
No. SGP.32 was designed for devices with no screen or user input. The eIM makes the decisions a consumer would make on a phone, and the IPA carries them out on the device [3].
What is an eIM?
The eSIM IoT Remote Manager (eIM) is the server-side component in SGP.32 that triggers profile downloads and enables, disables, and deletes profiles on IoT devices. It can be operated by a device maker, an enterprise, or a connectivity provider [3].
Does every eSIM support SGP.32?
No. An eSIM or eUICC can follow SGP.02, SGP.22, or SGP.32. Support for SGP.32 depends on the specific eUICC and its certification, so it should be confirmed with the SIM supplier.
Does SGP.32 work with LTE-M and NB-IoT?
Yes. SGP.32 is designed for network-constrained devices, including those on low-power cellular networks such as LTE-M and NB-IoT [6].
Sources
- GSMA, “eSIM Consumer and IoT Specifications.” https://www.gsma.com/solutions-and-impact/technologies/esim/esim-specification/ (accessed October 2026)
- GSMA, “M2M Specifications.” https://www.gsma.com/solutions-and-impact/technologies/esim/esim-m2m-specifications/ (accessed October 2026)
- GSMA, “How GSMA IoT and Consumer eSIM Powers Innovation.” https://www.gsma.com/solutions-and-impact/technologies/esim/about/
- GSMA, “GSMA Publishes ‘Embedded SIM’ Specification for Machine-to-Machine (M2M) Services,” December 19, 2013. https://www.gsma.com/newsroom/press-release/gsma-publishes-embedded-sim-m2m-services/
- GSMA, “GSMA Releases Remote Provisioning Specification to Help Consumers Connect Mobile Devices,” February 18, 2016. https://www.gsma.com/newsroom/press-release/gsma-releases-remote-provisioning-specification/
- GSMA, “SGP.31 eSIM IoT Architecture and Requirements,” April 19, 2022. https://www.gsma.com/solutions-and-impact/technologies/esim/gsma_resources/sgp-31-esim-iot-architecture-and-requirements/
- GSMA, “SGP.32 v1.3,” May 22, 2026. https://www.gsma.com/solutions-and-impact/technologies/esim/gsma_resources/sgp-32-v1-3/
- Trusted Connectivity Alliance, “Realising the Benefits of GSMA’s eSIM IoT Specification (SGP.32) Version 1.0,” September 2024. https://trustedconnectivityalliance.org/wp-content/uploads/2024/09/TCA_Realising-the-Benefits-of-SGP.32_FINAL.pdf
- Transforma Insights, “Remote SIM Provisioning Capability to Be Present in 57% of Cellular-Based IoT Shipments in 2035, with SGP.32 Strongly Dominating,” August 5, 2026. https://transformainsights.com/news/remote-sim-provisioning-capability-cellular-iot
- Juniper Research, “eSIM Connections to Reach 1.5bn Globally in 2026,” January 27, 2026. https://www.juniperresearch.com/press/esim-connections-reach-1bn-globally-in-2026/
- Juniper Research, “Cellular IoT: Latest GSMA eSIM Standard Critical to 6.5 Billion Connections,” June 10, 2025. https://www.juniperresearch.com/press/cellular-iot-latest-gsma-esim-standard-critical-to-6bn/
- ABI Research via PR Newswire, “eSIM-enabled Device Shipments Will Exceed 633 Million in 2026,” September 16, 2025. https://www.prnewswire.com/news-releases/esim-enabled-device-shipments-will-exceed-633-million-in-2026-driven-by-chinese-smartphone-adoption-and-sgp32-advancements-across-consumer-and-iot-markets-302557185.html
- RCR Wireless, “What Is SGP.31/.32 Specification and How Would It Impact IoT?” November 16, 2023. https://www.rcrwireless.com/20231116/devices/what-is-spg-31-32-specification-how-would-impact-iot
