Until 2024 there were two GSMA eSIM standards in production: SGP.02 for M2M (the classic "push" model driven by SM-DP + SM-SR) and SGP.22 for consumer (the mobile-phone "pull" model, with SM-DP+ and LPA). The first requires an SM-SR platform, usually proprietary to the connectivity provider, and moving between SM-SRs is a contractual nightmare. The second is open but assumes a UI — which a water meter does not have.
SGP.32 (GSMA specification published in 2023, volume implementation from 2024–2025) fills the gap. It is designed specifically for UI-less IoT and removes the need for SM-SR.
New architecture
- IPA (IoT Profile Assistant): replaces the SGP.22 LPA. Lives on the device or as an applet in the eUICC and handles profile download, activation and deletion.
- eIM (eSIM IoT Manager): remote platform that commands the IPA. Operated by the OEM, the integrator or the connectivity provider. The point: it is not tied to the eUICC vendor.
- SM-DP+: same as consumer. Prepares and delivers encrypted profiles. Any GSMA-certified SM-DP+ will do.
What it fixes versus SGP.02
- No more single-SM-SR lock-in. In SGP.02, moving a eUICC from one SM-SR to another (the infamous change-of-ownership) required active cooperation between SM-SR operators — and that cooperation historically did not happen.
- Works without the "owner" carrier's coverage. In SGP.02, the SM-SR pushes commands over the active profile's OTA channel. If that profile has no coverage, you are stuck. In SGP.32 the IPA reaches out to any available IP network and talks to the eIM over IP, bypassing the current mobile carrier.
- Real bulk operations. Moving thousands of devices to a new carrier stops being a manual per-SIM job.
What stays good about SGP.02
Nothing forces migration. SGP.02 eUICCs keep working, loaded profiles stay active and fielded devices do not get touched. SGP.32 is the recommendation for new designs from 2025 onwards, but the installed base will be SGP.02 for the rest of the decade.
When to require it in your RFP
- If the device is new and its lifecycle exceeds 7 years.
- If you will ship into several countries with different local-carrier requirements.
- If you want a real option to change connectivity provider without swapping the eUICC.
- If your silicon vendor (Qualcomm, Sequans, Sony Altair) already ships IPA-capable firmware — most modules released from 2024 do.
What to ask the provider
- Which exact SGP.32 version does the eUICC support (v1.0.x, v1.1.x)?
- Own SM-DP+ or external? GSMA-certified?
- Can I point my devices to an external eIM, or am I forced to use yours?
- How do you handle IPA certificate revocation if a device is compromised?