In late 2023, the GSMA quietly published a standard that’s set to reshape how IoT devices connect to mobile networks: the eSIM SGP.32.

It’s the companion to SGP.31, which defines the overall eSIM IoT Architecture. Together, they aim to make remote SIM provisioning (RSP) simpler, lighter, and more adaptable—especially for the millions of low-power or embedded devices that don’t fit neatly into the “consumer” or “M2M” categories.

In plain English: SGP.32 lets IoT devices securely download and switch operator profiles over the air, but without the heavy infrastructure or manual coordination that M2M systems required.
It’s designed for use cases where devices may lack screens, run on small batteries, or operate across multiple markets — from connected cars and smart meters to shipping trackers and industrial sensors.

Unlike its predecessors (SGP.02 for M2M and SGP.22 for consumer devices), SGP.32 separates the brains of eSIM management from the devices themselves. The core intelligence now lives in a cloud component called the eIM (eSIM IoT Manager), while devices only need a lightweight IPA (IoT Profile Assistant) client.
That division is what makes SGP.32 more scalable, efficient, and suitable for modern IoT fleets.

The Cubic³ + Thales Collaboration: Automotive as a Proving Ground

When Cubic³ and Thales announced their collaboration on SGP.32 in early 2024, industry insiders paid attention — and rightly so.
Cubic³ develops connectivity platforms for software-defined vehicles (SDVs), while Thales is one of the world’s largest suppliers of eSIM and secure-element technology.

The partnership aims to let automakers build vehicles that can download a local mobile profile after shipment, ensuring compliance with regional telecom laws and avoiding costly physical SIM logistics.
In practice, this means a car built in Germany could roll off the same production line whether it’s bound for the U.S., Japan, or Brazil — and automatically localize its connectivity once it reaches its market.

As Cubic³ explained in its blog “How Cubic and Thales Are Powering the Future of the Software-Defined Vehicle”, the integration of Thales’ GSMA-compliant RSP platform with Cubic³’s orchestration layer enables automotive OEMs to manage mixed fleets — those using both legacy SGP.02 systems and the new SGP.32 model — under a single management pane.
For Thales, this collaboration demonstrates that SGP.32 is not theoretical anymore; it’s being engineered into production pipelines for the connected-car market.

What’s Actually New in SGP.32

Under the hood, the changes may seem technical, but they solve real-world bottlenecks:

1. Cloud-based orchestration (eIM):
   The eIM handles tasks like profile downloads, activation, and lifecycle events centrally. Devices no longer need to maintain direct coordination with operator platforms — saving power, bandwidth, and complexity.
2. Lightweight device agent (IPA):
   Instead of embedding complex logic into each IoT device, SGP.32 uses a small agent called the IoT Profile Assistant to receive and execute secure commands from the eIM.
3. Simplified communications:
   Unlike older standards that relied on SMS or point-to-point exchanges between operators, SGP.32 uses standard IP protocols (HTTPS/TLS) and removes the need for donor–recipient coordination.
4. eUICC Controllable Operations (eCO):
   These define clear, secure procedures — download, enable, disable, or delete a profile — with cryptographic authentication and status reporting to the eIM. It’s more modular and auditable than before.
5. Hybrid backward compatibility:
   For years, many IoT deployments will remain on SGP.02. The new system is designed to coexist, letting OEMs manage both types of devices in parallel.

In short, SGP.32 modernizes eSIM provisioning for IoT without breaking compatibility with what’s already out there — a rare balance of innovation and pragmatism.

The Broader Market Context

SGP.32 doesn’t exist in isolation. It lands in a marketplace crowded with other approaches to global connectivity:

• SGP.02 (M2M RSP): The long-standing machine-to-machine standard, still used by industrial players but often criticized for rigid “donor/recipient” coordination and limited flexibility.
• Multi-IMSI SIMs: Offered by providers like Onomondo and Eseye, these embed several operator identities on one SIM and switch among them without changing profiles.
• Proprietary orchestration models: Some vendors use private APIs or “semi-over-the-air” processes to mimic RSP behavior before full SGP.32 compliance arrives.
• iSIM (integrated SIM): A newer hardware trend, integrating the SIM directly into a device’s chipset. iSIMs can still use the SGP.32 framework, but adoption is in its early stages.

What distinguishes SGP.32 is standardization. It’s backed by the GSMA, designed for interoperability, and supported by leading eUICC vendors — including Thales, IDEMIA, and Giesecke+Devrient.
In August 2025, IDEMIA became the first to announce full GSMA SGP.32 certification, signaling that certified deployments are finally ready to scale.

As Vodafone noted in its own briefing, SGP.32 will be key to addressing “the complexity of IoT deployments across multiple markets and connectivity providers”, reducing the need for manual operator integration in each country.

Why the Industry Needs This Shift

For years, the IoT connectivity story was stuck in a paradox: we could connect devices anywhere — but only by building fragile webs of roaming agreements or SIM-swap logistics.
SGP.32 tackles that directly.

By centralizing orchestration in the eIM, enterprises can dynamically select or change network profiles based on performance, regulation, or price. It also helps avoid “permanent roaming” violations, a growing headache in markets like Brazil, Turkey, and the EU.

For mobile operators, meanwhile, the new model opens a path toward offering connectivity-as-a-service to enterprises — with standardized APIs and better lifecycle visibility.
It’s no coincidence that most major players in the automotive and industrial IoT sectors are aligning around it: they see the potential to decouple hardware logistics from connectivity contracts.

Adoption Timeline and Early Leaders

We’re still early.
The first certified solutions only appeared in mid-2025, and analysts expect commercial deployments to ramp through 2026–2027.
Thales, IDEMIA, and G+D are all building compliant platforms; Cubic³, Eseye, and Vodafone are testing integration layers; and semiconductor vendors like Qualcomm and Sony Semiconductor Solutions are preparing iSIM-ready hardware aligned with SGP.32.

In this transitional phase, we’ll see “hybrid” setups — fleets combining SGP.02, SGP.32, and even multi-IMSI approaches under unified orchestration dashboards.
The standard doesn’t eliminate proprietary methods overnight; it creates a lingua franca that everyone can build around.

The Road Ahead: Orchestration Is the New Differentiator

As analysts at Transforma Insights point out, the most significant shift SGP.32 introduces isn’t just technical — it’s architectural.
Connectivity is becoming software-defined.
Enterprises will choose providers not merely for coverage or price, but for how well they orchestrate network switching, compliance, and analytics.

That’s where “eSIM Orchestrators” (a term gaining traction in 2025) come in — specialized platforms managing eIM functions, APIs, and integrations with multiple operators.
This middle layer could become the real battlefield of the next decade, sitting between MNOs, OEMs, and enterprises.

Conclusion: A Leap Forward—But Not Yet a Revolution

SGP.32 is arguably the most important update to the eSIM ecosystem since consumer eSIMs became mainstream.
It gives IoT players — from automakers to logistics firms — a standard way to stay connected globally without operator lock-in.

Compared to legacy M2M setups or roaming-based workarounds, it’s cleaner, smarter, and built for the realities of a multi-market world.
But it’s also complex. The standard’s success depends on how quickly MNOs, OEMs, and orchestration providers can align their systems, security models, and business rules.

The Cubic³ × Thales collaboration shows what’s possible when that alignment happens—vehicles that can switch profiles in minutes, not months.
IDEMIA’s certification shows that the tools are real.
And as orchestration platforms mature, we’ll finally see IoT connectivity behave the way it always should have: flexible, software-defined, and globally portable.

The revolution may take time — but the runway is clear, and the engines are already on.