SGP.32 in Mid-2026: Where UK and European IoT eSIM Actually Stands

SGP.32 eSIM News July 2026
IoT eSIM / SGP.32

SGP.32 in Mid-2026: Where UK and European IoT eSIM Actually Stands

Three years after the specification landed, IoT eSIM has stopped being a conference talking point and started shipping. Here is the state of play as of July 2026, with the UK front and centre and a look across Europe.

For most of its life, SGP.32 has been a standard people talked about rather than deployed. That changed decisively over the first half of 2026. Certified hardware is now shipping, commercial SIM deliveries have begun, and the orchestration platforms that sit above the standard are moving from slideware to general availability. The tone across the industry has shifted from “coming soon” to “available to order”.

The headline for anyone tracking the standard itself: the GSMA quietly moved the goalposts again. On 28 May 2026 it published SGP.32 v1.3, alongside a matching SGP.31 v1.3 architecture update. Most vendor sites and explainer pages still reference v1.2, which remains the version formal certification is issued against, so the two will coexist for a while yet.

Version watch. SGP.32 shipped as v1.0 in May 2023 and reached its stable, certifiable form at v1.2 in late 2024. That is still the baseline for GSMA certification of eUICCs, eIM platforms and SM-DP+ servers. SGP.32 v1.3 was published on 28 May 2026, so expect certification programmes and vendor documentation to catch up over the coming months rather than overnight.

The UK: quietly holding a strong hand

The UK’s position in IoT eSIM is stronger than its modest volume of press releases suggests, largely because two of the most important companies in the ecosystem are British.

Kigen, the Hampshire-based eSIM specialist spun out of Arm, has become one of the reference points for SGP.32 done properly. Its GSMA-certified eUICC hardware ships in multiple form factors, including the solderable MFF2 and the compact 2mm x 2mm MFF4, and its eIM platform paired with the Kigen Pulse orchestration console is among the first to be widely adopted. Kigen also has a hand in the standard itself: its head of standards chairs one of the GSMA eSIM working groups. In April the company partnered with KORE on global SGP.32 provisioning, and in early July it teamed with Denmark’s Onomondo on an interoperable, pre-loaded SGP.32 offering already being tested across Europe and North America.

Eseye, based in Guildford, moved in late April to fold SGP.32 into its AnyNet+ eSIM and Infinity connectivity management platform, supporting all three remote provisioning standards from a single managed interface. That “manage SGP.02, SGP.22 and SGP.32 from one place” positioning is telling: the near-term reality is a mixed estate, not a clean switch, and the value is increasingly in the orchestration layer rather than the raw standard.

The operator picture

On the network side, the UK landscape has consolidated. Following the completion of the Vodafone and Three merger, the country is now served by three mobile network groups: VodafoneThree, EE and Virgin Media O2. All are working on SGP.32-native commercial offerings at various stages, providing the underlying 4G, 5G and NB-IoT infrastructure that fleets will actually run on. Vodafone in particular has been vocal, having restructured its IoT business over the past couple of years partly on the strength of the eSIM and iSIM shift.

Across Europe: the first movers

If the UK holds the hardware and orchestration cards, mainland Europe has produced most of the visible commercial launches.

Telenor IoT (Norway) is arguably the furthest ahead among operators, having begun commercial delivery of fully standardised SGP.32 SIMs on 17 April 2026, pitched explicitly against non-standardised alternatives on an anti-lock-in argument. Tele2 IoT (Sweden), IDEMIA Secure Transactions (France) and Cisco used Mobile World Congress in Barcelona back in March to launch one of the first end-to-end SGP.32 solutions. emnify (Germany) is pushing programmable SGP.32 across its cloud-native SuperNetwork, leaning on remote profile switching and embedded fallback profiles as resilience features.

On silicon and secure elements, Germany’s Giesecke+Devrient and Thales (Cinterion) remain central, with G+D’s automotive-grade eSIM and eIM stack now in a flagship production deployment on Rivian’s R2 platform alongside AT&T. Module vendors including Quectel and Fibocom are shipping certified SGP.32 hardware, which is the quiet prerequisite that unlocks everything downstream.

PlayerBaseDevelopmentWhen
Tele2 IoT / IDEMIA / CiscoEuropeEnd-to-end SGP.32 solution, launched at MWCMar 2026
emnifyGermanyProgrammable SGP.32 across SuperNetworkMar 2026
KORE + KigenUS / UKGlobal SGP.32 provisioning partnershipApr 2026
Telenor IoTNorwayCommercial standardised SGP.32 SIM deliveries begin17 Apr 2026
EseyeUKSGP.32 added to AnyNet+ and Infinity CMP22 Apr 2026
Onomondo + KigenDenmark / UKInteroperable, pre-loaded SGP.32 eSIMs6 Jul 2026
SoracomJapan / USSGP.32 eSIMs + Connectivity Hypervisor reach general availability8 Jul 2026

The numbers behind the noise

The forecasts have been repeatedly revised, and mostly in one direction: later, then bigger. The GSMA estimates 195 million SGP.32 profile downloads by 2029, around 70% of all IoT eSIM activity by that point. ABI Research, having trimmed its 2025 expectations, now sees the real acceleration arriving in the second half of 2026 and scaling hard through 2027, growing from single-digit millions of downloads today toward roughly 194 million by 2029. Kaleido Intelligence puts around 50 million SGP.32-compliant eSIMs under management globally by 2027.

The consistent thread is that 2026 is the ramp, not the peak. The installed base is still overwhelmingly SGP.22 and legacy SGP.02, and that will remain true for years. But for genuinely new hardware designs, especially anything targeting NB-IoT, LTE-M or multi-operator global deployment, SGP.32 is now the sensible default rather than a bet on the future.

Regulation on the horizon. The EU Cyber Resilience Act starts to bite this year. Vulnerability and severe-incident reporting obligations begin on 11 September 2026, with the broader set of requirements applying from 11 December 2027. For IoT eSIM specifically, that raises the bar on choosing a security-assured, GSMA SAS-accredited subscription management environment, because long-lived fleets will need an auditable patching story for the next decade, not just a working provisioning flow on day one.

What it actually means

Strip away the launches and a clear pattern emerges. The standard is no longer the differentiator; the orchestration layer is. Almost every serious announcement this year, from Eseye to Soracom to Kigen Pulse, is really about the management platform that sits between the enterprise and the underlying eUICC, eIM and SM-DP+ machinery. SGP.32 compliance is becoming table stakes, and “avoid vendor lock-in” is hardening into a standard line in enterprise procurement.

For UK and European buyers, the practical advice has not changed much, but it has firmed up. Specify SGP.32-capable eUICC hardware in any new design, favour components certified against v1.2 (and keep an eye on the v1.3 transition), and weigh the eIM platform as heavily as the connectivity itself, because that is where the switching costs and the long-term operational value both live.

Sources: GSMA eSIM specification pages (SGP.32 v1.3, published 28 May 2026); company announcements from Telenor IoT, Tele2 IoT, IDEMIA, emnify, Eseye, Kigen, Onomondo, KORE, Soracom and Giesecke+Devrient; market forecasts from GSMA, ABI Research and Kaleido Intelligence; EU Cyber Resilience Act reporting timeline. Commercial status reflects the market as of July 2026 and will be updated as the ecosystem develops.