First Steps Before You Write a Word

An IoT business is two businesses bolted together: a hardware company that designs, certifies and ships a physical device, and a software company that runs a cloud platform, sells subscriptions and supports the fleet for years. The plans that win funding treat both halves honestly. The ones that fail describe a clever gadget and forget that the real cost, and the real margin, lives in the software, the connectivity and the multi-year support commitment.

Before you draft a single section, get five decisions on paper. They shape every number that follows.

• Pick your half of the market. Consumer IoT (smart-home, wearables, connected appliances) sells high volume at low price with heavy support and retail costs. Industrial IoT (asset tracking, predictive maintenance, factory and fleet sensors) sells fewer units at higher value on multi-year contracts. The two demand different pricing, churn assumptions and even different regulators, decide which one you are.
• Choose the connectivity layer. Wi-Fi and Bluetooth are cheap but tether the device to a local network. Cellular (4G/LTE-M/NB-IoT/5G) and LoRaWAN free the device to roam but add a recurring data cost per unit for the life of the product. That recurring cost belongs in your model from day one.
• Decide build vs. buy on the platform. Standing on a managed platform such as AWS IoT Core or Azure IoT Hub gets you to market faster; building your own gives control but adds months and headcount. Either way, name the platform in the plan and show you understand its cost curve.
• Map your regulatory path early. If the device has a radio it needs FCC, CE or UKCA authorization. If it touches consumers it falls under the UK PSTI Act and, soon, the EU Cyber Resilience Act and the FCC Cyber Trust Mark. These are not afterthoughts; they set your launch date.
• Write the recurring-revenue story first. Investors fund the annual recurring revenue (ARR) curve, not the device shipment count. If you cannot articulate what customers pay every month after they buy the hardware, you do not yet have a plan.

Work through those five and the rest of the plan, costs, pricing, operations, forecast, falls into place with far less guesswork. The free template below is sequenced to walk you through each one in turn.

What It Costs to Build an IoT Product

Plan for $50K to $750K (roughly £40K to £600K) to take a connected-device business from concept to a funded launch. A bare proof of concept can be scoped at $18K-$25K, and a basic end-to-end MVP that joins hardware, firmware and cloud starts around $50,000, according to ITRex Group, 2026. The single most useful planning fact: hardware feels like the expensive part, but software and cloud typically absorb 60-70% of the total budget, and security a further 15-25%.

Cost Breakdown

• Hardware design + 2-3 prototype iterations: $15K-$120K (£12K-£95K). Most products need two or three PCB-and-enclosure cycles before they are production-ready, at $15K-$40K per iteration, per WebbyLab, 2026.
• Firmware, cloud platform + companion app: $25K-$300K (£20K-£240K). The largest line in most budgets, device firmware, the cloud back end, dashboards and the mobile or web app.
• Security & compliance engineering: $10K-$90K (£8K-£70K). Secure boot, encrypted comms, key management and the testing needed for Cyber Trust Mark / CRA readiness. Cutting this is the most common cause of expensive rework.
• Certification & regulatory testing: $8K-$60K (£6K-£48K). FCC, CE and UKCA radio/EMC testing, billed per radio module.
• Production tooling + first inventory run: $10K-$150K (£8K-£120K). Injection-mould tooling and the minimum order quantity for your first batch.
• Connectivity & platform setup: $4K-$45K (£3K-£35K). Cellular SIM provisioning, data plans, MQTT broker and platform configuration.
• Legal, IP/patents & incorporation: $3K-$25K (£2K-£20K). Entity setup, terms of service, privacy policy and any patent filing.

Funding Routes

In the US, the SBA 7(a) loan is unusually well-suited to connected-device founders because it can finance research and development, prototype work, testing and field validation, not just equipment. The average 7(a) loan in FY2024 was $443,097, and the programme approved 70,242 loans worth $31.1 billion, its highest loan count in more than 15 years, per Crestmont Capital (SBA data), 2024. Lenders generally want a 680+ personal credit score, a 20-30% equity injection from the founder, and a detailed plan with projections. IoT hardware typically sits under NAICS 334210/334290 (communications equipment) and IoT software or systems integration under 541512.

In the UK, the government-backed Start Up Loan offers up to £25,000 per founder at a fixed 6% rate, and Innovate UK grants regularly fund connected-hardware and smart-product R&D. Many deep-tech founders also use SEIS/EIS to make equity attractive to angels. A blended raise, a little grant money, a Start Up Loan and SEIS equity, is common at seed stage. Whichever route you choose, our market research and content service builds the financial model lenders and grant assessors expect to see.

Platforms, Connectivity & Suppliers

One question separates a credible IoT plan from a hopeful one: which platform are you building on, and do you understand its cost curve? Three hyperscalers, AWS, Microsoft and Google Cloud, hold more than 80% of public-cloud IoT workloads, according to IoT Analytics, 2025, but specialist platforms often fit hardware startups better. The platforms below are the ones investors will recognise and the ones your plan should reference by name.

• AWS IoT Core, serverless, connects millions of devices over MQTT with mutual TLS; the default choice for sheer scale and deep integration with AWS analytics and AI.
• Microsoft Azure IoT Hub, bi-directional messaging with per-device identities and device twins; the natural pick if you already live in the Microsoft and Azure data stack.
• Google Cloud, strong on the data-and-AI side once device telemetry lands; the third hyperscaler option.
• Particle, an end-to-end stack popular with hardware startups for cellular products; acquired by Digi International in January 2026, per Windows News, 2026.
• ThingsBoard, open-source platform for teams that want to self-host and avoid hyperscaler lock-in.
• PTC ThingWorx, Bosch IoT Suite & Siemens Insights Hub, industrial-grade platforms built for manufacturing, asset management and predictive maintenance.

Connectivity providers

For cellular products, connectivity is a managed service in its own right. Global SIM and eSIM providers (the likes of those serving LTE-M and NB-IoT fleets) bill per device per month, which is why a 10,000-unit fleet carries a five- or six-figure annual connectivity line that your model must carry too. For short-range products, Wi-Fi and Bluetooth modules from established silicon vendors keep the bill of materials down at the cost of roaming freedom.

The practical rule for the plan: name your primary platform, name your connectivity approach, and show the per-device monthly cost of both. Reviewers do not expect you to have signed contracts at seed stage, they expect you to know the numbers exist and to have built them into the unit economics. For an adjacent category, the way these supplier choices play out is similar in our smart home business plan template and industrial automation business plan template.

Certification & Security Regulation

IoT is now one of the most heavily regulated categories a hardware founder can enter, and the rules tightened sharply in 2024-2027. Two layers apply: radio/equipment authorization (always required if the device transmits) and cybersecurity regulation (increasingly required if the device touches consumers). Budget for both in time and money, they routinely add months to a launch.

United States

• FCC equipment authorization, mandatory for any device with a radio (Wi-Fi, Bluetooth, cellular, LoRa). Expect $5K-$30K in testing and filing per radio module and a 4-12 week turnaround.
• FCC U.S. Cyber Trust Mark, a voluntary cybersecurity label for consumer IoT, aligned to NIST IR 8425. The ioXt Alliance was named Lead Administrator effective 13 April 2026. It is optional today, but every vendor supplying consumer IoT products to the US government must carry it by 4 January 2027, per the FCC, 2026.
• State privacy law, CCPA/CPRA in California and a growing patchwork of state statutes if the device collects personal data; HIPAA for health-connected devices; COPPA if children use the product.

United Kingdom

• PSTI Act 2024, in force since 29 April 2024 for consumer connectable products. Three duties: ban universal default passwords, publish a vulnerability-disclosure policy, and declare the minimum period for which security updates will be provided. It aligns to ETSI EN 303 645, and non-compliance can cost up to £10 million or 4% of global turnover, per GOV.UK, 2024.
• UKCA marking + radio testing, required for the Great Britain market; radio devices must meet the UK Radio Equipment Regulations. Budget £6K-£40K and 4-10 weeks.
• ICO registration under UK GDPR, the data-protection fee runs £52-£2,900 where the device processes personal data.

European Union

• Cyber Resilience Act (CRA), the big one. Security-by-design is required, vulnerability-reporting duties begin 11 September 2026, and full Annex I conformity is required for products placed on the market from 11 December 2027. It carries a 24-hour incident-reporting rule, roughly five years of security support and ten-year documentation retention, with penalties up to €15 million or 2.5% of global turnover, per the European Commission, 2026.
• CE marking + RED radio testing, the standard route to placing a radio product on the EU market.
• GDPR, applies wherever the device processes the personal data of EU residents.

The common thread across all three jurisdictions is that security is now a legal product requirement, not a feature. A plan that names the PSTI Act, the CRA and the Cyber Trust Mark, and shows a realistic compliance timeline, signals to investors that you will not be blindsided by a launch-blocking certification.

How IoT Businesses Make Money

The defining commercial fact of IoT is that the device is rarely where the profit is. Hardware gross margins are thin, typically 15-35% after the bill of materials, assembly and returns, while recurring software, data and platform revenue carries 70-85% gross margin. The businesses that sustain profitability do it on the recurring line, which is why the shift from one-time product sales to service revenue is the central commercial challenge for connected-product companies, as Zuora, 2025 frames it.

Four revenue models do most of the work, and the strongest plans blend them:

• Subscription, a recurring monthly or annual fee for the dashboard, alerts, updates and platform access. The most widely understood and most bankable IoT revenue line.
• Usage-based billing, charging by device activity, data processed, hours of operation or transactions. Scales revenue with the value the customer actually gets.
• Hardware-as-a-Service (HaaS), you keep ownership of the device and the customer pays one recurring fee covering hardware, software, maintenance and eventual replacement. Removes the upfront-cost barrier and locks in the relationship.
• Data monetisation, aggregated, anonymised telemetry sold to third parties, where privacy law and customer terms allow.

A worked example

Take a connected asset-tracking startup. It ships 1,200 trackers at $90 each against a roughly $74 unit cost, so hardware throws off about 18% gross, useful for cash, but not the engine. The engine is the $12 per device per month subscription. At 1,200 active devices that is $172,800 in annual recurring revenue at around 80% gross margin: the recurring line contributes roughly $138,000 of gross profit a year, versus about $19,000 from the hardware sale. By year three, at 4,000 active devices, recurring ARR reaches $576,000. The device sale is the customer-acquisition event; the subscription is the business. A plan that forecasts only the 1,200 units shipped, and not the ARR build behind them, will read as half a model to any lender or investor.

The numbers that actually decide whether this works are not the headline shipment count but the unglamorous ones: net revenue retention, monthly churn, RMA/return rate, and the per-device connectivity cost that quietly recurs for the life of every unit. Model those four and the forecast becomes defensible.

Who Buys IoT & How They Decide

A connected device is bought for what it does after it is installed, not for the hardware itself. That changes how you describe the customer. A strong IoT plan names the buyer precisely, shows what triggers the purchase, and proves the ongoing value is worth a recurring fee. Vague claims about a huge addressable market are the fastest way to lose a reviewer; specific buyers with a measurable pain are what earn the next meeting.

The plan should make the segment choice explicit and then build pricing, sales cycle and support assumptions around it. An enterprise asset-monitoring deal might take six to nine months to close but run for years at thousands of pounds a month; a consumer wearable converts in minutes but needs constant marketing spend to replace churned users. Forcing one go-to-market model onto the wrong segment is a common reason early forecasts miss.

Go-to-market that matches the buyer

• Consumer: performance marketing, marketplace and retail listings, content and reviews, plus a referral loop to lower the cost of replacing churn.
• SMB: search-intent traffic, partnerships with installers and resellers, and a free pilot or short trial that proves payback on real data.
• Enterprise: direct and partner-led sales, proof-of-concept deployments, and security/compliance documentation ready before the first procurement call.

Tie each channel to a customer-acquisition cost, a conversion rate and an expected lifetime, so the marketing budget in your forecast is grounded rather than guessed. The same discipline applies in adjacent connected categories such as the home automation business plan template, where channel economics decide whether the model scales.

Operations: Prototype to Fleet

IoT operations span two worlds that rarely sit in one founder's head at once: a physical supply chain that has to design, certify and manufacture a device, and a software operation that has to keep thousands of those devices online, secure and updated for years. Reviewers want to see that you have thought about both, and about the handover between them. This section of the plan is where you prove you can deliver, not just design.

The hardware path

• Design and prototype, schematic, PCB layout, enclosure, and two or three iterations to reach a production-ready unit. Plan for design-for-manufacture review before tooling.
• Certification, FCC, CE and UKCA radio and EMC testing, scheduled early because it gates your launch and is billed per radio module.
• Contract manufacturing, almost every IoT startup uses an electronics manufacturing services partner rather than owning a line. Name the manufacturer type, the minimum order quantity, and the unit cost at first-run volume.
• Logistics and returns, fulfilment, warranty handling and an RMA process. Returns are a real cost line in hardware and belong in the model.

The software and fleet path

• Provisioning and onboarding, how a new device securely joins the platform and the customer's account on first power-up.
• Over-the-air updates, a reliable OTA pipeline is non-negotiable; it is how you patch security issues and meet PSTI and CRA support obligations.
• Monitoring and support, fleet dashboards, alerting, and a support function sized to the installed base, not to today's small pilot.
• Security operations, key management, vulnerability disclosure handling, and the 24-hour incident reporting the CRA will require from 2026.

The operational metrics that matter most are device activation rate, OTA success rate, fleet uptime, support tickets per thousand devices, and RMA rate. Tracking these from the first pilot is what lets you see margin erosion before it becomes structural, and it is exactly the operational rigour a lender or grant assessor looks for. Our bespoke business plan service builds these operational KPIs into the plan and the financial model together.

Market Size, Demand & Growth

The global IoT market was worth $864.32 billion in 2025 and is projected to reach $1,055.02 billion in 2026 on its way to $5.55 trillion by 2034, a 23.10% compound annual growth rate, according to Fortune Business Insights, 2025. That figure spans hardware, connectivity, platforms and services; narrower scopes put the number lower, but every credible source agrees the direction is steeply upward.

Three demand signals matter for a founder choosing where to compete. First, healthcare is the largest end-use segment, at roughly a 20.10% share in 2026, with agriculture growing fastest as field equipment goes connected. Second, deployment has gone overwhelmingly to the cloud, cloud captured about 78.38% of the market, which validates building on a managed platform rather than racking your own servers. Third, while North America leads on revenue, Asia Pacific is the fastest-growing region, a useful fact if your supply chain or first customers sit there.

Two sub-markets are worth watching because they frame your costs. The IoT platform layer is forecast to grow from about $44.30 billion in 2025 toward $65.29 billion by 2030 (an 8.1% CAGR), per MarketsandMarkets, 2025, while the IoT devices (hardware) segment is growing faster, from roughly $230 billion in 2025 toward $535 billion by 2031, per Mordor Intelligence, 2025. Translation for your plan: hardware volume is expanding quickly, but the durable margin and the recurring revenue concentrate in the platform and services layer above it.

Mistakes That Sink IoT Startups

The failure patterns in connected hardware are remarkably consistent. Reviewers have seen them all, so a plan that pre-empts them reads as seasoned. These are the six that most often derail an otherwise good idea.

• Selling a gadget, not a service. Treating IoT as a one-time hardware sale leaves no recurring revenue to fund support, security updates and the cloud bill. Build the subscription or usage line from the start.
• Value-engineering out the security. Stripping security to hit an early budget is the most common cause of costly mid-project reinstatement and post-launch remediation. Security is 15-25% of the build and, after the PSTI Act and CRA, a legal requirement, not a feature to cut.
• Ignoring per-device connectivity cost. Cellular data and platform fees recur for the life of every unit. A model that omits them looks profitable on a spreadsheet and bleeds margin in production.
• Underestimating certification. FCC, UKCA and CE radio testing plus the new security duties add months and tens of thousands of dollars. Founders who discover this late miss their launch window.
• Choosing a platform you cannot exit. Deep lock-in to one hyperscaler's proprietary services makes a later migration painful and expensive. Keep an architectural exit in mind even if you start managed.
• Forecasting shipments without churn, returns or support cost. A device-count forecast is not a financial model. Without churn, RMA/return rates and the multi-year cost of firmware support, the numbers will not survive diligence.

More Questions Founders Ask

What should an IoT business plan include that a generic plan doesn't?

Beyond the usual executive summary, market analysis and financials, an IoT plan needs four extra exhibits: a device-shipment-to-active-device-to-ARR build, a per-device connectivity and platform cost line, a regulatory compliance timeline (FCC/PSTI/CRA), and a capital schedule covering certification, tooling and first inventory. Those four are what reviewers look for to tell a real operator from a hobbyist.

How long does it take to bring an IoT product to market?

From concept to shipping, most teams spend 9-18 months. Two or three hardware prototype cycles take the bulk of it, and certification adds 4-12 weeks per radio module on top. Building on a managed platform shortens the software path; designing custom hardware lengthens the whole timeline.

Do I need to own the hardware factory?

No. Almost all IoT startups use a contract manufacturer or an electronics manufacturing services partner rather than building a factory. Your plan should name the manufacturing approach, the minimum order quantity for the first run, and the unit cost at that volume, not assume you own the line.

Is industrial IoT or consumer IoT the better business to start?

Industrial IoT generally offers higher contract values, longer customer lifetimes and lighter consumer-regulation exposure, but a slower, relationship-led sales cycle. Consumer IoT scales faster on volume but carries thin margins, heavy support, retail costs and the full weight of the PSTI Act and Cyber Trust Mark. Pick the one that matches your access to customers and your tolerance for support load.

Sample Business Plan Preview

Preview the structure and financial outputs a buyer receives. These visual mockups are generated from the same assumptions used throughout this page.

What's in the Template

Every Avvale business plan template includes these sections, pre-structured for an IoT venture:

• Executive Summary, your business at a glance, written to hook investors in 60 seconds
• Company Overview, legal structure, ownership, location and founding story
• Industry Analysis, IoT market size, growth trends and the regulatory picture
• Customer Analysis, consumer vs. industrial buyers, pain points and willingness to pay
• Competitor Analysis, platform and device-maker mapping and your differentiation
• Marketing Plan, channels, messaging and customer-acquisition strategy
• Operations Plan, manufacturing approach, fleet support and key milestones
• Management Team, founder bios, advisory board and planned key hires

The optional Financial Forecast add-on (included in our $300/£250 and $1,000/£800 packages) provides a 5-year Excel model with income statement, cash flow, balance sheet, break-even analysis, an ARR and active-device build, and the startup capital requirements specific to a connected-device launch.

Frequently Asked Questions

Useful Links & Resources

A few related Avvale resources and our social channels, kept here so important references are easy to find.

• Browse all free business plan templates
• 5G services business plan template, the connectivity backbone for many IoT products
• LinkedIn
• YouTube