September 29, 2026 · 9 min read · Procurement & Strategy
EIOPA: 17% of carriers sell IoT-linked motor cover. Permanent-roaming rules and SGP.32 eSIM shift UBI SIM buying from per-GB to project quote.
Usage-based insurance (UBI) connectivity is the cellular data path that carries driving-behaviour and sensor telemetry from an insured asset into a rating, pricing or claims platform. The procurement entry point is now regulatory rather than geographic: EIOPA data cited by Mordor Intelligence shows 17% of carriers already offer motor insurance linked to IoT, and Progressive logged 18% policy-in-force growth on its telematics programme, so carrier identity and profile residency sit directly under the insurance pricing model.
Buying it breaks into four cost lines: telematics hardware, the data plan, CMP platform fees, and logistics and support. Self-install telematics units are quoted in the €20–€60 range based on published supplier rate cards; low-volume telemetry data plans sit at roughly €0.50–€2.00 per SIM per month at catalog pricing; multi-country data and platform work go to project quote. The reference economics come from the 10%–25% premium credits carriers now attach to verified IoT monitoring, which InsuranceNewsNet reports are shifting from incentive to a prerequisite for continued market participation.
That is why a 5,000-device programme rarely behaves like a per-GB negotiation. Across published carrier rate cards, the data line is frequently the smallest of the four, while carrier attribution and retention periods determine whether the insurer can actually defend the credit it granted.
The procurement constraint has flipped inside two years. A UBI SIM decision used to compare coverage footprint against price per MB; IoT Business News reports the market is moving away from simple coverage comparisons and price-led decisions toward providers that can arbitrate national policies, roaming exposure and profile localisation without repeated hardware interventions.
The second shift is enforcement. Spenza's 2026 multi-carrier roaming guide notes that governments are tightening telecom regulation and operators are watching long-term foreign SIM usage, with regulators questioning why devices operating permanently inside a country still use foreign telecom identities years after installation. That lands directly on the classic single-roaming-profile UBI dongle.
The third is service life. Spenza documents enterprise IoT deployments expected to remain active for more than 10 years, which means a connectivity decision taken now must stay supported and compliant into the 2030s. On the insurance side, Mordor Intelligence notes Europe's EU Data Act and the forthcoming Cyber Resilience Act standardise device security and data sharing across 27 member states, while Canadian regulators are tailoring AIDA and CPPA to balance innovation with consumer sovereignty.
Deutsche Telekom and DriveFactor announced this exact shape of turnkey stack in 2013 — tracking module, SIM card for the insured vehicle, platform services and statistical evaluation of driving data — which establishes the SIM as part of a service contract rather than a standalone line item. Programmes at this scale typically run catalog-priced M2M SIMs up to a few hundred units, then move onto a CMP platform with RESTful M2M provisioning endpoints once activation, swap and deactivation volumes need automation.
The Hyundai Motor Group and Vodafone IoT deployment across Bahrain, Saudi Arabia, Kuwait, Qatar and the UAE shows the OEM route: regulatory-compliant in-car connectivity delivered through regional network partners such as e& UAE. For an insurer buying OEM data feeds, this becomes an eSIM discussion, because profile localisation has to happen across a 10-year-plus vehicle life without a workshop visit.
Commercial lines are multi-country by definition, so a multi-carrier global IoT SIM plus an IoT SIM management layer avoids renegotiating a single-carrier contract every time a vehicle crosses a border. The compliance posture of permanent roaming still has to be designed in from the start rather than discovered at renewal.
Mordor Intelligence cites State Farm's mass deployment of Ting sensors, and InsuranceNewsNet documents 10%–25% premium credits tied to verified roof hardening, defensible space and IoT monitoring. These are low-bandwidth, fixed-location, multi-year devices — the profile where an industrial SIM with a supply and profile commitment matching a 10-year-plus service life beats a consumer-grade plan.
Uploads that support a claim have to be attributable to a specific carrier on a specific date. That is a CMP reporting and API problem rather than a data-volume problem, and it is the reason per-upload logging and RESTful M2M endpoints enter the RFP at all.
The table below maps the four procurement-relevant dimensions that changed with SGP.32 maturation and permanent-roaming enforcement. Values marked with source brackets come from the cited material; buying motions are stated as typical ranges, not fixed price points.
| Dimension | Physical M2M SIM | eUICC / SGP.32 eSIM | Multi-Carrier Global IoT SIM |
|---|---|---|---|
| --- | --- | --- | --- |
| Profile change method | Unit swap or workshop visit per device | Remote profile update, no hardware intervention [1] | Steering-policy change via CMP or REST API |
| Design horizon assumption | One fixed profile for a 10+ year service life [2] | Refreshable profile across the same 10+ year life [2] | Refreshable at contract renewal |
| Regulatory exposure | Multi-year foreign operation invites permanent-roaming scrutiny [2] | Supports localised operator profiles per market [1][2] | Hinges on host-profile residency policy |
| Platform dependency | SIM inventory management only | Orchestration, policy-based routing, fleet compliance tooling [1] | CMP plus RESTful M2M activation endpoints |
| Primary cost driver | Per-SIM unit price plus logistics | Per-device provisioning plus platform fee | Per-SIM data plus verification overhead |
| Typical buying motion | Catalog pricing at hundreds of units | Project quote from low thousands of devices | Project quote for multi-country fleets |
SGP.32 maturation, per IoT Business News, raises the bar for orchestration platforms and pushes the market toward automation, policy-based routing and fleet-level compliance tooling. In procurement terms that converts part of a per-SIM line item into a platform line item, and platform fees are generally project-quoted rather than catalogued.
Procurement managers note that the largest hidden cost in connected-device connectivity is not per-GB pricing but evidence-chain verification — proving which carrier carried a specific upload at a specific time.
That cost never appears on a rate card. It surfaces when an insurer has to justify a premium credit [6] or defend a claim, and it scales with the number of carriers the upload path touches rather than with the number of devices on the fleet. A programme running one carrier per market has a shorter verification path than a multi-carrier roaming fleet of identical size.
Deployment teams report that a lower per-MB quote can carry a higher total verification load when uploads traverse three or four carriers instead of one. The selection logic that follows is practical: single-country private motor programmes under a few hundred units stay on catalog-priced physical M2M SIMs; cross-border fleets and OEM-embedded lines move to eSIM with a CMP platform; and any deployment where the insurer must attest to carrier-of-record per upload goes to project quote with per-upload logging specified as a deliverable.
Use physical SIMs at catalog pricing when the device population stays national, sits below roughly a few hundred to low thousands of units, and the field profile never needs to change. The data allowance is the only variable you are negotiating, and a standard IoT data plan with a bundled MB bucket covers it.
Move to eUICC with SGP.32 remote provisioning when the device service life exceeds 10 years [2] or the fleet crosses regulatory borders. IoT Business News describes the shift as one from pure connectivity procurement to lifecycle and risk management, which is precisely what a 10-year device commitment forces.
Trigger a project quote — not a catalog order — when three conditions appear together: more than one national regulatory regime in scope, permanent-roaming exposure that Spenza says regulators may question after years of foreign operation [2], and a requirement to produce carrier-of-record evidence per upload. Catalogues cannot express any of those three.
Self-install telematics units sit in the €20–€60 band based on published supplier rate cards. The hardware itself is rarely the swing factor; SIM logistics, activation batches and replenishment stock are where the fulfilment budget actually moves at scale.
Low-volume telemetry plans are catalogued in the €0.50–€2.00 per SIM per month band with bundled MB allowances. Higher-frequency uploads that approach video-adjacent data volumes leave the catalogue entirely and are priced per project against committed volume tiers.
CMP platform fees are project-quoted because they scale with orchestration scope rather than device count alone. IoT Business News frames the market push as automation, policy-based routing and fleet-level compliance tooling — platform capabilities, not SIM features, and the reason platform pricing resists catalogue comparison.
Physical SIM programmes carry recurring replenishment, swap and inventory costs across a service life Spenza puts at more than 10 years. eSIM programmes replace unit swaps with remote profile operations [1], so the maintenance assumption you model matters more than the unit price you negotiate.
Work the credit against the recurring line. A 10%–25% credit band [6] applied to verified IoT monitoring must cover hardware amortisation across a 10-year-plus service life [2] plus the monthly data and platform lines. Amortising €20–€60 of hardware over 120 months yields roughly €0.17–€0.50 per device per month, which is why the data and platform lines decide net programme economics.
Counted separately from the three lines above, verification scales with carriers in the upload path and retention period, not device count. Because it depends on fleet topology and regulatory jurisdiction, it is quoted per project — and it is the line most often missing from a spreadsheet comparison.
Catalog pricing is enough when the deployment fits one national footprint, device counts stay in the hundreds to low thousands, telemetry stays low-volume, and no one needs per-upload carrier attestation. In that configuration a standard IoT data plan plus a physical M2M SIM covers the requirement, and the buying motion is a catalogue order with published per-SIM and per-MB rates.
Project quote is required when any of four triggers fires: localised profiles are needed to answer permanent-roaming questions [2], profile switching must happen without hardware intervention [1], the fleet spans multiple national regulatory regimes across 27 EU member states or separate frameworks such as AIDA and CPPA [7], or the insurer must prove carrier-of-record per upload. Each of those changes the contract structure, the platform scope and the support obligation, so no catalogue rate card expresses them.
The practical test before any renewal: if you cannot trace a specific telematics upload back to a named carrier at a named time without manual reconciliation, the programme is carrying an unpriced verification line — and that line, not the per-GB rate, is what will be reviewed when the premium credit [6] is audited.