Clear
girls with smart watch and eSIM

eSIM standards evolution explained: SGP.22, SGP.32 and LITE4 interoperability for OEMs 

Bee Hayes-Thakore Bee Hayes-Thakore
October 21, 2026

GSMA eSIM standards determine how connected products are activated, secured and managed throughout their life. Bee Hayes-Thakore, in conversation with Dr Saïd Gharout, Chair of the GSMA eSIM Technical Working Group and Head of Standardization at Kigen, explore eSIM standards evolution and what comes next. 

girls with smart watches on eSIM

eSIM is everywhere, and the examples on our website show how widely. It’s in smartphones and consumer devices, point-of-sale payment terminals, smart meters, industrial connectivity, manufacturing, and even cattle trackers. 

For the companies building and deploying connected products, eSIM standards shape some of their biggest decisions: which vendors to choose, how fast to reach market, and how much risk to take on along the way. Kigen has long worked to make GSMA eSIM standards clear and usable across IoT, M2M and consumer markets. 

IoT is where much of that work began, but Kigen also offers an end-to-end eSA certified consumer eSIM stack as well, and helps shape the Consumer eSIM RSP specifications. Kigen’s latest GSMA eSA-certified eSIM portfolio spans consumer, industrial IoT and automotive. It includes the industry’s first eSA-certified consumer eSIMs supporting SGP.22 v2.7, the latest release of the standard. 

The GSMA working groups deliberate on and decide which capabilities are requested and included in each published specification, and Kigen helps shape them directly through this collaborative process. Dr Saïd Gharout, Kigen’s Head of Standardization, chairs the GSMA eSIM Technical Working Group. 

The industry’s next milestone is proving that independently developed SGP.32 implementations work together reliably. For anyone planning large IoT deployments, that interoperability is what makes a multi-vendor strategy viable. GSMA’s upcoming LITE4 interoperability event will put it to the test across the ecosystem. 

Ahead of GSMA’s LITE4 interoperability event, I asked Saïd the questions OEMs, connectivity providers and eSIM sourcing teams ask most often about eSIM standards. His answers are below. 

Why do eSIM standards matter for OEMs and connected product manufacturers? 

eSIM standards give manufacturers a shared foundation to build on. Products from different suppliers work together, and OEMs keep their choice of connectivity partner. 

“Standards create shared interfaces that let companies innovate independently while building products that work together.” Dr Saïd Gharout

Saïd points to USB-C and HTML5 as familiar examples. Both succeeded because a common specification was backed by testing to show that implementations work together. For eSIM, he says, the stakes “extend from smartphones and wearables to payment terminals, smart meters, industrial equipment and connected fleets,” and many of these products stay in service for a decade or more. Our eSIM best practice guide covers the fundamentals. 

Which GSMA standards apply to eSIM? 

The GSMA defines eSIM standards in three families: M2M, Consumer and IoT. Today, Consumer and IoT dominate the market. 

“The first eSIM specifications were dedicated to the M2M market through SGP.01/02. Today, the market is mainly dominated by two families of eSIM standards: Consumer (SGP.21/22) and IoT (SGP.31/32).” (Dr Saïd Gharout) 

Consumer specifications cover smartphones and other B2C devices. See 5 ways to win as travel eSIMs take flight and how GL.iNet and Kigen are transforming the 5G travel experience. IoT specifications are mainly used in B2B deployments. Alongside them, the GSMA publishes specifications for testing, security, and compliance. 

What is the difference between SGP.02, SGP.22 and SGP.32 eSIM specifications? 

They are the three GSMA specifications behind M2M, consumer, and IoT eSIM deployments. Each defines a different way of delivering and managing eSIM profiles remotely.  

  • SGP.02 (M2M): Profile delivery is managed through an SM-SR and an SM-DP. 
  • SGP.32 (IoT): Adds an eSIM IoT Manager (eIM) and an IoT Profile Assistant (IPA) for devices with limited user interaction or connectivity. 

“The choice depends on how the product will be activated – for instance, is it via user choice or is there no direct user pull to request the profile for connectivity. The second element is how the profile download is remotely managed and who wishes to retain control over the connectivity operations through its lifecycle: this will determine which type of server you need to manage it. Thanks to the market penetration of SGP.22, SGP.32 was developed on top of it, adapting to IoT devices that may have limited or no local user interaction, or limited network bandwidth, as is the case with LPWAN.” (Dr Saïd Gharout) 

To go deeper, download the OEM guide to IoT eSIM success or read our guide to IPA, LPA and SGP.32 

What is the latest version of the GSMA eSIM standards? 

The latest versions are SGP.22 v2.7 for consumer devices and SGP.32 v1.3 for IoT, published in April and May 2026 respectively. Saïd expects the market to adopt them quickly. 

“As those versions introduce new enhancements, we think the market will quickly move to SGP.32 v1.3 for IoT and SGP.22 v2.7 for Consumer. We were the first to declare SGP.22 v2.7 and SGP.32 v1.3 products to GSMA.” (Dr Saïd Gharout) 

When can customers buy eSA-certified eSIMs supporting SGP.22 v2.7 and SGP.32 v1.3? 

They are available now. Kigen’s latest GSMA eSA-certified eSIMs already support both versions, and the newest eUICC is automotive grade. 

“This is thanks to Kigen’s ability to be agile and develop products in parallel with the specifications at GSMA.” (Dr Saïd Gharout) 

The portfolio runs on Infineon’s TEGRION™ SLx22 family: SLC22 for consumer devices, SLM22 for industrial IoT and SLI22 for automotive. It includes the first eSA-certified consumer eSIMs to support SGP.22 v2.7. 

What’s new in SGP.32 v1.3 and SGP.22 v2.7? 

The headline changes are security improvements. Third-party applets on the eUICC are now more isolated from one another, test profiles are more tightly controlled, and installing applets in test profiles is restricted to prevent malicious behavior. Several of these protections began at Kigen. 

“The rejection of applet installation in test profiles was first introduced by Kigen and then included in the standards.” (Dr Saïd Gharout) 

The standards also now cover eUICC OS updates, which Kigen had already implemented. SGP.32 keeps the features M2M deployments relied on: fallback, rollback and emergency profiles. It also standardizes how a device retrieves its connectivity settings, such as the APN, from the active profile when the device doesn’t already know them. 

What is in-factory profile provisioning (IFPP), and what is SGP.42? 

In-factory profile provisioning loads an eSIM profile onto a device during manufacturing, before it is deployed. GSMA is standardizing IFPP as SGP.42, which is expected in 2027. 

IFPP matters most for high-volume products, where provisioning each device in the field over SGP.22 or SGP.32 can be difficult. 

“This will be a true shift for IoT devices, where the profile will be preloaded and the device factory-fitted with connectivity. It will allow ready-to-go devices and save battery for constrained devices, as the first in-field profile operation can be problematic to long service life.” (Dr Saïd Gharout) 

Why is SGP.32 eSIM a game changer for automotive and large vehicle fleets? 

The first benefit of SGP.32 is that it is fully interoperable end to end. Any vehicle or device can connect to any SM-DP+ without prior negotiation or custom work, which is what manufacturers need to scale connected fleets. 

“SGP.32 is a game changer for automotive. An eIM that implements all the options, as Kigen’s eIM does, will absorb all the complexity and complete the missing actions on the device. The device can focus on implementing the minimum required.” (Dr Saïd Gharout) 

The specification spells out what a device must do, whether it runs its own profile assistant (an IPAd) or relies on the one built into the eUICC (an IPAe). High-end devices can connect directly to the SM-DP+. Devices that are limited by design can rely on the eIM to handle profile delivery, a method called Indirect Profile Download. Kigen’s eIM supports any type of device. Read more on why automakers are turning to eSIM. 

What eSIM security challenges should automakers prepare for, including post-quantum cryptography? 

The next major change is post-quantum security. GSMA has started work to make SGP.32 quantum-safe, and Kigen is already preparing for the move to post-quantum cryptography (PQC). 

“The next major shift will be to post-quantum security.” (Dr Saïd Gharout) 

SGP.32 lets device makers choose whether to put some security functions on the device or rely on the eUICC. Saïd also notes that some of its interfaces were deliberately left for later releases, so the first versions could focus on what was needed for the technology to take off: profile download and remote management through the eIM. 

“SGP.32 was designed to be incremental and backward compatible. It hasn’t yet revealed all its potential.” (Dr Saïd Gharout) 

What is GSMA LITE4 and why does SGP.32 interoperability testing matter? 

LITE4 is a GSMA event that tests whether independently developed SGP.32 implementations work together in practice. It runs from 26 to 30 October 2026, hosted by Thales in La Ciotat, France. Kigen will take part with its certified IoT eSIMs and eIM. 

“Security assurance, specification compliance and interoperability answer different questions.” (Dr Saïd Gharout) 

Saïd advises OEMs to look for evidence of successful combinations, which functions were exercised, and any limitations found. He also cautions against over-reading the results: they show what was tested, “without implying that every possible product combination has been validated.” For more context, read our SGP.32 reality check. 

How should OEMs evaluate SGP.32 eSIM interoperability? 

When assessing interoperability claims, OEMs should ask vendors for: 

  1. The named eUICCs, eIMs, devices and SM-DP+ platforms tested, and the specification versions used. 
  1. The full set of profile operations covered: install, enable, disable, delete and reporting. 
  1. Support for the direct or indirect download path their device needs. 
  1. Whether the IPA sits on the eUICC (IPAe) or on the device (IPAd). 
  1. Evidence of recovery from interrupted downloads and loss of connectivity. 
  1. Technical and commercial terms that let them change providers over the product’s lifetime. 

“These questions turn ‘interoperable’ into evidence an OEM can use.” (Dr Saïd Gharout) 

To test this hands-on, try the Kigen IoT eSIM Starter Kit. For OEMs, the priority is to choose a secure platform that can be updated, and to use interoperability evidence to keep connectivity choice open as products scale.