Most people meet eSIM as a QR code. Scan it, wait, and a mobile plan appears. That experience hides the technology underneath: the eUICC, a secure component that stores, authenticates and manages downloadable operator profiles.

An eSIM profile is the digital bundle containing a subscriber’s network credentials. The eUICC is the protected environment that receives it, verifies it and controls whether it can be enabled, disabled or deleted. Conversation calls both “eSIM,” but they are not interchangeable.

That distinction is becoming important. GSMA Intelligence expects eSIM smartphone connections to overtake removable SIM connections by 2030, while the industry pushes eUICC into cars, trackers, meters and industrial equipment deployed for a decade. The QR code is only the visible front door.

More than storage

A conventional UICC, the plastic SIM, normally arrives with an operator subscription loaded. Changing provider usually means changing the card. An eUICC supports Remote SIM Provisioning, allowing authorised profiles to be downloaded and managed without replacing secure hardware.

It is not a loose software wallet. The eUICC remains a tamper-resistant environment using certificates, cryptographic controls and policy rules. The GSMA’s compliance framework covers eUICCs, devices and subscription-management servers because interoperability depends on the complete chain.

READ MORE: Remote SIM Provisioning (RSP): The Technology Powering eSIM Flexibility

On consumer devices, an SM-DP+ server prepares and delivers the operator profile, while a Local Profile Assistant manages installation. The GSMA’s consumer specifications include SGP.21 and SGP.22 version 2.7, issued in April 2026.

This explains why two eSIM-capable phones can behave differently. Transfers, profile limits, dual-SIM behaviour and activation methods still depend on device software, modem support and operator integration.

The consumer reality

For travellers, eUICC has turned mobile connectivity from a shop visit into a downloadable product. Profiles can be stored and switched without opening a tray. Multiple Enabled Profiles goes further: compatible Android devices can expose several eUICC ports, allowing more than one profile on a single eUICC to remain active.

Moving a subscription between devices has been less graceful. Apple’s 2026 documentation describes cross-platform transfers between iPhones and Android devices, depending on carrier and manufacturer support. Customers still encounter QR-code reissues, support calls and activation policies that feel less digital than the technology.

READ MORE: What Is a eSIM Profile? Everything You Need to Know About eSIM Profiles

A removable SIM therefore remains practical for people who frequently swap phones, rely on older hardware or want a physical fallback. eUICC is elegant when the surrounding ecosystem works. When it does not, the user cannot pull out the chip and continue elsewhere.

IoT raises the stakes

The larger eUICC story is now IoT. A connected car, payment terminal or shipping tracker cannot be opened whenever its connectivity contract changes. They may be scattered, sealed, underground or screenless. Remote profile management turns connectivity from a factory decision into a lifecycle decision.

The GSMA’s SGP.32 specification targets network-constrained or user-interface-constrained IoT devices. Version 1.3, published in May 2026, uses an architecture built around an IoT Profile Assistant and an eSIM IoT Manager. Compared with the older SGP.02 machine-to-machine model, SGP.32 uses an IP-based approach and reuses established SM-DP+ infrastructure.

READ MORE: MEP eSIM: Why Multiple Profiles Matter Now

Manufacturers want one product design, not separate hardware for every operator and country. In theory, a globally shipped device can receive the appropriate profile after deployment and later change provider. In practice, enterprises still need compatible modules, certified eUICCs, tested platforms, commercial agreements and operations. “Supports SGP.32” is a starting point, not a connectivity strategy.

A competitive layer

The supplier market is moving quickly. Giesecke+Devrient said in April 2025 that it became the first company to achieve GSMA eSIM compliance and eUICC Security Assurance for an IoT eUICC under SGP.32 version 1.2. Thales, IDEMIA and Kigen also sell eUICC, provisioning and IoT management portfolios, positioning complete stacks rather than chips.

Secure hardware is essential, but customers judge vendors on integration, orchestration, fleet visibility, migration support and freedom to work across operators. The competitive question is becoming less “Who supplies the eUICC?” and more “Who can keep millions of devices connected without creating another form of lock-in?”

There is also iSIM, or integrated eUICC, which moves SIM functionality into a device’s system-on-chip instead of using a separate soldered component. It promises smaller designs for power-sensitive hardware. Yet iSIM does not erase eUICC; it changes where the secure functionality lives. For many products, a discrete eUICC remains easier to source, certify and integrate.

Security is the product

Remote programmability increases flexibility, but also the number of parties and interfaces that must be trusted. The eUICC must protect operator credentials; provisioning servers must authenticate correctly; device software must preserve user intent; and teams must control who can order, download or delete profiles.

Researchers analysing consumer Remote SIM Provisioning have identified weaknesses under partial-compromise scenarios and recommended implementation and process improvements. The GSMA responded publicly and maintains security assurance, certification and application-note programmes. This does not make eUICC inherently unsafe. It shows that telecom-grade security is never a finished checkbox.

Buyers should ask unglamorous questions. Which specification is supported? Is the eUICC certified? Who controls the management platform? Can profiles be migrated? What happens if the original provider disappears? A cheap profile is little use if an entire fleet becomes stranded.

Conclusion

eUICC is often described as the technology that removes plastic from mobile connectivity. True, but incomplete. Its real value is separating a device’s secure identity hardware from the operator subscription loaded onto it.

In consumer travel, that creates convenience and choice. In IoT, it changes procurement, manufacturing and bargaining power. G+D, Thales, IDEMIA and Kigen are competing across secure components and management layers, while iSIM pushes the same capability deeper into silicon. Winners will make switching credible, security verifiable and large deployments manageable.

Physical SIM will survive where removability, simplicity or legacy compatibility matters. iSIM will gain ground in tightly integrated, power-sensitive devices. Between them, eUICC remains the practical centre: mature enough for mass deployment, flexible enough for new business models and complicated enough that implementation quality separates a real platform from a polished promise.