Regulatory authorities worldwide are introducing and refining requirements affecting IoT and machine-to-machine (M2M) services.

Providers must increasingly consider a growing range of regulatory obligations when operating across borders. These include mandatory subscriber identification and dedicated M2M numbering cybersecurity reporting and satellite connectivity.

What are regulators' focus areas?

Regulators globally are focusing on:
 

• SIM registration and numbering: Spain introduced mandatory dedicated numbering for new M2M services, while Mexico has subscriber identification requirements for mobile lines, except for certain M2M services.
   
• Cybersecurity and data governance: Manufacturers of connected products must now meet reporting obligations under the EU Cyber Resilience Act. In Nigeria, short incident reporting deadlines were introduced for telecoms providers, while Kenya issued guidance on the international transfers of personal data.
   
• Satellite and private network connectivity: Japan adopted new rules for satellite links to mobile terminals, China outlined priorities for satellite IoT, and the USA proposed allowing unlicensed IoT devices to communicate directly with satellites. Oman and the UAE consulted on regulatory frameworks affecting private mobile networks.
   
• Network evolution and connectivity markets: South Korea aims to retire 3G services, while the UK expanded its voluntary 2G retirement scheme. Brazil examined wholesale access conditions for IoT providers, including pricing and access.

What does this mean for IoT providers?

The developments illustrate that regulatory obligations increasingly depend on the specific connectivity model, the services offered and the responsibilities of the parties involved.

For companies deploying connected devices internationally, understanding these differences is essential to assessing market access, operational compliance and the long-term continuity of IoT services.

The above findings are drawn from Cullen International's latest Quarterly Regulatory Update on IoT and M2M Services – 3Q 2026, available to subscribers of Cullen's IoT service.

Scope

Region: Global
Countries covered: 65
Policy area: Internet of Things
Last updated: October 2026

For more information and to access the research, please click “Access full content” or “Request access” if you are not a subscriber to our IoT service.