Short answer: Yes, IoT SIM cards are regulated, and the rules depend on where the device is used. The five areas to check are permanent-roaming rules (Brazil and Turkey ban foreign SIMs from roaming long term), SIM and subscriber registration, device cybersecurity rules such as the EU Radio Equipment Directive delegated act (in force since 1 August 2025) and the Cyber Resilience Act (reporting duties since 11 September 2026), data protection such as GDPR, and sector rules for areas like healthcare and critical infrastructure. Com4 helps devices stay compliant with multi-network SIMs, eUICC and SGP.32 eSIM for local profiles, and SIM control in the Polaris connectivity management platform.
Regulation rarely stops an IoT project at the start. It shows up later: a batch of trackers blocked in Brazil after a few months, a customer's procurement team asking for your Cyber Resilience Act plan, or a tender in Norway that asks where device data is processed. By then the hardware is built and the cheap options are gone.
This guide covers the rules that most often affect connected devices with SIM cards, and how to plan for them. It is a practical overview, not legal advice. Check the details for your own markets with your legal team.
1. Permanent roaming rules
Most IoT SIMs work by roaming: a SIM from one country uses networks in another. That is fine for a phone on holiday. It becomes a problem when a device stays abroad for years, because some regulators and operators don't allow foreign SIMs to sit on their networks permanently.
- Banned by regulation: Brazil and Turkey prohibit permanent roaming. Nigeria is often listed in the same group.
- Effectively prohibited: China and India require local licences or local registration, and several Middle East markets require a locally registered supplier.
- Restricted by operators: The US, Canada and Australia have no legal ban, but local operators can limit or block long-term roaming.
- Generally allowed: Inside the EU and EEA, permanent roaming is allowed under the roaming rules, although operators can apply fair-use policies.
The fix is to use a local operator profile in restricted markets. That means a multi-IMSI SIM with a local identity, or an eUICC with SGP.32 that can download a local profile over the air. Read more in our guide to permanent roaming challenges.
2. SIM and subscriber registration
Many countries require every SIM to be registered to a known person or company. Rules vary: some apply only to consumer services, some to all SIMs, and some, such as Turkey and Indonesia, also require device IMEI registration. Keep a clean record of which company owns each SIM, which device it sits in and where that device is used. A connectivity management platform makes this an export rather than a project.
3. Device cybersecurity rules in the EU
Two EU rules now apply directly to connected devices:
- Radio Equipment Directive delegated act (EU) 2022/30. Since 1 August 2025, internet-connected radio equipment placed on the EU market must meet cybersecurity requirements on network protection, personal data and fraud prevention. The harmonised standards are EN 18031-1, -2 and -3. Without them, the CE marking is not valid for affected products.
- Cyber Resilience Act (EU) 2024/2847. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents within tight deadlines, also for products already on the market. From 11 December 2027, the full requirements apply, including secure design, security updates and CE marking.
Connectivity is part of your answer to both. A private APN, encrypted tunnels and the ability to push updates over the air make security requirements much easier to meet. See Com4's IoT security services.
4. Data protection and data location
If your devices collect data about people (location, health, energy use in a home), GDPR applies in the EU and EEA, and similar laws apply elsewhere. Ask your provider where traffic is routed and processed. Customers in the public sector, healthcare and critical infrastructure will often ask for data to stay in the EU or EEA, and will ask for this in tenders.
5. Sector and critical-infrastructure rules
Some industries add their own layer. Energy companies, water utilities, transport and healthcare providers fall under NIS2 in the EU, and pass security requirements down to their suppliers. Medical devices have their own regulation. Electricity meters and EV chargers often have national technical requirements. These rarely mention SIM cards directly, but they shape what your connectivity has to deliver in uptime, security and reporting.
6. Network shutdowns
Not a law, but it works like one. When operators switch off 2G and 3G, devices that depend on them stop working. Norway, Sweden and many other markets have announced or completed shutdowns. Plan for LTE-M, NB-IoT or 4G, and read our guide on preparing for 2G and 3G shutdowns.
How to stay compliant across countries
- List every country where devices will be used, including future markets on the roadmap.
- Check each one for permanent-roaming and registration rules before you lock the hardware.
- Choose a SIM that can use local profiles: multi-IMSI, eUICC with SGP.32, or both.
- Keep SIM ownership, device and location records in one platform.
- Use a private APN and encrypted connections, and plan for remote updates.
- Document how you meet RED and Cyber Resilience Act requirements, including vulnerability reporting.
- Ask your provider where traffic is processed, and get it in writing.
- Work with a provider that follows rule changes in your markets for you.
The short version
IoT SIM regulation comes from several directions at once: roaming, registration, cybersecurity, data protection and sector rules. None of it is hard to handle if you plan for it before the hardware is built. All of it gets expensive if you discover it after.
Compliance is cheapest on the drawing board.
If you're planning a deployment across several countries, Com4 can go through your markets with you and show where you need local profiles, registration or extra security. No slides, just the rules that apply to your devices.
