Why IoT App Development is the Next Big Opportunity for Businesses in India
Written by Gowtham Raj, Director at TartLabs, who leads IoT, mobile, and custom software engagements for manufacturing, logistics, and enterprise clients.
Disclosure: TartLabs builds the kind of systems described here commercially. Where that shapes a view, it is flagged in the "Our take" notes.
The Short Answer
India's IoT opportunity is not a forecast. It is an installed base that is already metered, already connected, and mostly not yet useful.
M2M, machine-to-machine, is the regulatory category TRAI uses for SIMs issued to devices rather than people. There were 137.70 million M2M cellular connections live on Indian networks at the end of July 2026. There are 5.73 crore smart electricity meters installed under the central metering scheme against 20.33 crore sanctioned there, and 7.24 crore in the ground once state schemes are counted too. 5G service reaches 99.9% of districts, carried by 5.63 lakh base stations as on 30 June 2026. Every one of those numbers is a public counter published by a regulator or a ministry, not a market projection.
What almost none of that hardware has is an application layer worth the name: something that turns a stream of readings into a decision a specific person makes on a specific day. Mind that gap between instrumented and useful, because it is where the opportunity sits — and closing it is software work, not device work.
Key Takeaways
- India had 137.70 million M2M cellular connections at the end of July 2026, up from 134.73 million a month earlier, per TRAI's monthly subscription data released 28 August 2026 (as reported by TelecomTalk). That is under 3% of the world's roughly 4.7 billion cellular IoT connections.
- 7.24 crore smart meters were installed nationwide as on 30 June 2026, of which 5.73 crore under the Revamped Distribution Sector Scheme. RDSS has sanctioned 20.33 crore, meaning about 14.6 crore meters — and the apps behind them — are still to come. The scheme's sunset moved to 31 March 2028.
- Scope, not measurement, drives the market-size numbers: Persistence Market Research puts India IoT devices at $9.7 billion for 2026, while Market Research Future puts the India IoT market at $58.65 billion for 2025 — a six-fold gap between two mainstream publishers. Plan against installed-base counters instead.
- India already won the device layer: electronics production reached ₹13.11 lakh crore in 2025-26 and mobile phones became the country's largest single export item. Domestic value addition rose from 15% to 23%. The software layer on top is the part still unowned.
- Globally, enterprise IoT grew 13% to $324 billion in 2025 with 14% forecast for 2026, and IoT Analytics names India and China as the growth drivers.
- Compliance is now a design input, not paperwork: TEC 31318:2021 bans universal default passwords on consumer IoT, MTCTE routes security-relevant equipment through ITSAR testing, CERT-In requires reporting IoT incidents within six hours, and the DPDP Act governs the telemetry.
- The IoT security statistic most often quoted — one million bots generating 40% of DDoS traffic — comes from Nokia's 2023 report. The current 11th annual edition reports terabit-scale DDoS as a daily event, up from once every five days in 2024.
Why the Market-Size Numbers Are Worse Than Useless
Start here, because most India IoT business cases start with a forecast and the forecasts do not agree.
Take two mainstream research publishers. Persistence Market Research values the India IoT devices market at $9.7 billion in 2026, reaching $44.4 billion by 2033 at a 24.3% CAGR. Market Research Future values the India Internet of Things market at $58.65 billion in 2025, growing at 19.6% to 2035. Six times apart, one year apart, and both are what a search for the size of India's IoT market hands you first.
Neither is wrong. They are counting different things. Persistence counts devices — wearables, smart home, industrial, connected vehicles, healthcare, metering, retail and agriculture hardware. Market Research Future counts application, component, end-use and network technology, which is the full stack including the software and services layered on top. The scope is stated if you read for it, and almost never stated when the figure is quoted onward. Other published estimates sit at various points between and beyond these two.
The practical consequence: a market-size slide cannot tell you whether to fund an IoT build, because you cannot tell from the headline which of those markets you would be entering. Substitute counters that are published, dated, and attributable. India has unusually good ones.
| Instead of this | Use this | Source and vintage |
|---|---|---|
| "India IoT market to reach $X billion" | 137.70 million M2M cellular connections, end July 2026 | TRAI telecom subscription data, released 28 Aug 2026 |
| "Smart city spend will grow at Y% CAGR" | Operational ICCCs in all 100 Smart Cities; ~97% of 8,064 sanctioned projects delivered | Press Information Bureau / Ministry of Housing and Urban Affairs |
| "Utility IoT is a $Z billion opportunity" | 7.24 crore smart meters installed, 20.33 crore sanctioned under RDSS | Ministry of Power reply in Parliament, data as on 30 Jun 2026 |
| "5G will enable IoT" | 5,62,971 5G base stations as on 30 Jun 2026, up from 1,40,623 in Mar 2023; 99.9% of districts | Ministry of Communications reply in Parliament, Jul 2026 |
| "Indian manufacturing is digitising" | Electronics production ₹13.11 lakh crore in FY26; domestic value addition 15% to 23% | Ministry of Electronics and IT, 15 Jul 2026 |
Our take: Across the India IoT engagements we have scoped — a handful, not a dataset — the counter that moved the decision has consistently been an installed-base number the client could verify themselves: meters in their circle, vehicles in their fleet, machines on their floor. We cannot recall a CAGR changing anyone's mind. When a business case rests on a market forecast, it often means nobody has counted the addressable assets yet, and counting them is the first week of work.
The Demand Is Already Connected
India's connected-device base is large, growing steadily, and heavily concentrated.
TRAI's monthly telecom subscription report for July 2026, released on 28 August 2026, put M2M cellular mobile connections at 137.70 million, up from 134.73 million at the end of June. Bharti Airtel holds 84.45 million of those, a 61.33% share, followed by Reliance Jio at 26.56 million (19.29%), Vodafone Idea at 21.92 million (15.92%), and BSNL at 4.77 million (3.46%).
Two things in that data matter more than the headline. First, growth is broad rather than spiky: all four operators added connections month on month, and between January and July 2026 Airtel added 14.27 million (up 20.3%), Jio 5.96 million (up 28.9%), and Vodafone Idea 3.11 million (up 16.5%). Second, the concentration means integration reality is simpler than it looks — build against two operators' platforms and you have covered about 80% of the installed base.
Put that next to the global picture and the headroom argument takes shape, with one caveat worth stating plainly. IoT Analytics counted 21.1 billion connected IoT devices worldwide at the end of 2025, growing 14%, of which cellular accounted for 4.7 billion, or about 22%. India's M2M base is a small fraction of that global cellular figure — but the two are not counted on the same definition. TRAI's M2M category covers SIMs registered as machine-to-machine on Indian networks; IoT Analytics builds its cellular IoT number on its own methodology, and the two vintages differ by seven months. Precise arithmetic across them would be exactly the scope error this article opened by criticising.
What survives the caveat is the direction. A country with roughly 18% of the world's population and the second-largest mobile phone manufacturing industry on earth holds a low-single-digit share of global cellular IoT connections on any of these counts. That gap is an argument rather than a measurement, but it is the kind of gap that tends to close.
The Single Largest IoT Programme in the Country Is a Software Problem
If you want one worked example of where Indian IoT app demand comes from, use electricity metering.
RDSS is the Revamped Distribution Sector Scheme, the Government of India programme that funds metering and loss-reduction work at state electricity distribution utilities. Under RDSS, launched in July 2021, smart metering has been sanctioned for 45 distribution utilities across 28 states and union territories, covering 19.79 crore consumer meters, 52.53 lakh distribution transformer meters and 2.05 lakh feeder meters, reported as a sanctioned total of 20.33 crore. As on 30 June 2026, 5.73 crore had been installed under RDSS, with 7.24 crore in the ground nationwide once state schemes and the National Smart Grid Mission are included — figures given by the Minister of State for Power, Shripad Naik, in a written reply to Parliament reported on 6 August 2026. Roughly 28% of the sanctioned RDSS scope has therefore been delivered, which is why the scheme's sunset date has been pushed to 31 March 2028.
Now look at what the government itself says about the software on top. A feedback survey run by the RDSS nodal agencies, REC and PFC, covered 1,24,590 consumers who had downloaded a DISCOM smart-metering app. Of those, 54,321 were aware of the app's real-time consumption feature and 72,494 of its recharge and bill-payment option (Press Information Bureau, 2 February 2026). Read carefully, that is a survey base rather than a national download total, so it says nothing about reach — but among people who had already installed the app, 44% did not know it showed them their live consumption. The headline feature of smart metering was invisible to nearly half its own users.
The utility side of the ledger is doing better, and that is the point: the ministry reports aggregate technical and commercial losses improving from 21.91% in FY2021 to 15.04% in FY2025, attributing this to reform measures including smart metering (Press Information Bureau, 2 February 2026). The meter and the billing backend are producing value. The consumer-facing and operations-facing applications largely are not.
For anyone building software, that shape repeats across Indian IoT: hardware procurement is centrally funded and moving, while the applications that make the data actionable are locally scoped, under-specified, and wide open. Fourteen crore meters still to come, each one attached to a consumer who will need an app that works on a mid-range Android phone with intermittent connectivity, is not a market forecast. It is a specification.
India Won the Device Layer. The App Layer Is Still Open
The manufacturing story is genuinely remarkable, and it explains why the software opportunity looks the way it does.
A decade of industrial policy moved these numbers, all from the Ministry of Electronics and IT on 15 July 2026:
| Measure | 2014-15 | 2025-26 |
|---|---|---|
| Electronics production | ₹1.90 lakh crore | ₹13.11 lakh crore |
| Electronics exports | ₹38,263 crore | ₹4.24 lakh crore ($47.96 bn) |
| Mobile phone production | ₹18,900 crore | ₹6.27 lakh crore |
| Mobile phone exports | ₹1,566 crore | ₹2.60 lakh crore |
| Mobile phones as an export item | 153rd largest | India's largest |
| Domestic value addition | 15% | 23% |
India is now the world's second-largest mobile phone manufacturer, electronic goods are the country's third-largest export category, more than 40 major component manufacturers have set up or expanded here, and the sector supports nearly 25 lakh jobs.
Sustained industrial policy won the device layer outright. What it has not produced at comparable scale is Indian-owned IoT product software: the platform, the fleet-management layer, the mobile app, the analytics that decide what a reading means.
Globally, that layer is where the money is accumulating. IoT Analytics puts the enterprise IoT market at $324 billion in 2025, up 13% year on year, with 14% growth forecast for 2026 and India and China named explicitly as the drivers. Knud Lasse Lueth, the firm's CEO, sums up where the market sits: "IoT has become a baseline capability for many enterprises, and the discussion is shifting toward Industrial AI and autonomous operations" (State of Enterprise IoT 2026, published January 2026).
Two consequences follow for an Indian business deciding what to build:
- Do not compete on the device. The component ecosystem, the contract manufacturers and the certification path already exist domestically. Sourcing a competent sensor or gateway is a procurement exercise now, not a differentiator.
- Compete on what the data decides. The defensible product is the layer that converts telemetry into an action with a named owner: dispatch a technician, hold a shipment, throttle a load, flag a meter. That layer is domain-specific, hard to copy, and almost never bundled with the hardware.
Our post on the role of artificial intelligence in IoT app development covers where models genuinely earn their place in that layer, and where they do not.
Where the Demand Actually Sits, Sector by Sector
Five sectors stand out to us as combining instrumented assets, a funded mandate, and a missing application. These are the ones we see enquiries about.
| Sector | What is already instrumented | The application gap | The anchor fact |
|---|---|---|---|
| Power distribution | 7.24 crore smart meters; DT and feeder meters | Consumer app, prepaid recharge journeys, load and outage analytics for DISCOM operations | 20.33 crore sanctioned under RDSS; 28% installed as on 30 Jun 2026 |
| Commercial transport | AIS-140 vehicle location tracking devices with GPS, NavIC and panic button, transmitting to certified backends | Fleet operations, driver safety workflows, fitness and permit compliance tied into VAHAN | Ministry of Road Transport and Highways standard; scoped by Rule 125H of the Central Motor Vehicles Rules to public service and national-permit vehicles |
| Manufacturing | Legacy machines, PLC and SCADA data, PLI-funded new lines | Retrofit connectivity, OEE and downtime analytics, maintenance scheduling | PLI for large-scale electronics drew ₹20,600 crore of cumulative investment to 31 Mar 2026 |
| Urban infrastructure | ICCCs live in all 100 Smart Cities, integrating AI, IoT and data analytics; traffic, water and waste sensing | Department-level operational apps and citizen-facing services on top of the ICCC | All 100 cities have operational ICCCs; the mission closed at roughly 97% of 8,064 sanctioned projects |
| Logistics and cold chain | FASTag, e-way bill, tracker fleets, ULIP APIs | Exception-driven visibility, condition monitoring, loss prevention | Covered in depth in our IoT supply chain guide |
The pattern is consistent. In none of these five is the constraint sensing. In all five it is that somebody has to write the software that decides what a reading means, and then integrate it with the system of record where work actually gets assigned.
Manufacturing deserves a note, because it is the sector where Indian expectations most often outrun reality. Adoption is uneven by firm size, with large enterprises considerably further along than mid-size firms and MSMEs, and in the plants we have worked in the dominant technical obstacle is the age of the installed machinery rather than any shortage of platforms to buy. A retrofit programme built on edge gateways, protocol translation and a small number of well-chosen signals will usually beat a full Industry 4.0 platform on both cost and time to value. That is an unglamorous conclusion, and it is the one we keep arriving at.
What Compliance Now Requires at Design Time
Indian IoT regulation has moved from advisory to enforceable, which changes the architecture rather than just the paperwork.
- TEC 31318:2021, the Code of Practice for Securing Consumer IoT, issued by the Telecommunication Engineering Centre under the Department of Telecommunications and aligned with ETSI EN 303 645, is the baseline document for consumer IoT security. Universal default passwords are prohibited outright. Per-device credential provisioning is therefore a first-sprint concern, not a hardening pass before launch.
- MTCTE, the Mandatory Testing and Certification of Telecom Equipment regime under the Indian Telegraph (Amendment) Rules, 2017, requires telecom equipment to be tested and certified before sale, import or use. For security-relevant categories it invokes Indian Telecom Security Assurance Requirements, tested at designated labs. If your product includes a radio, the certification calendar belongs in the project plan.
- CERT-In reporting under Section 70B of the IT Act, 2000 requires cyber incidents involving attacks on IoT devices to be reported within six hours. A six-hour clock is an operational commitment: it presumes fleet-wide telemetry, alerting, and a named on-call rota. Design that in or you will not meet it.
- The DPDP Act governs the personal data inside the telemetry. Consumption patterns, location traces and in-home sensor readings are personal data with obvious inference risk, and the RDSS standard bidding documents already fold DPDP compliance into smart-metering procurement alongside communication security, cloud security requirements and incident management.
Our take: The cheapest moment to satisfy all four is while the data model is still a whiteboard. The most expensive is after a pilot has shipped with a shared device password and unpartitioned consumer telemetry, which is among the more common remediations we get called into. Treat per-device identity, tenant isolation and an incident runbook as launch requirements rather than a phase two.
The Security Numbers Everybody Quotes Are Out of Date
Two statistics dominate IoT security conversations in India, and both need handling.
The first is that "75% of IoT projects fail." It traces to a Cisco survey from May 2017 of 1,845 decision-makers across the US, UK and India, which actually found that 60% of initiatives stalled at proof of concept and 26% of companies rated an initiative a complete success. No respondent reported a 75% failure rate. We pulled that number apart in detail in our IoT supply chain post; the short version is that the figure blends three separate findings into one round number, and that nine-year-old evidence predates LTE-M, current low-power silicon and essentially every managed IoT platform on the market today.
The second is more current-sounding and just as stale: the claim that roughly one million compromised IoT devices generate more than 40% of all DDoS traffic. That figure is real, and it is from Nokia's Threat Intelligence Report of 2023 — a report whose own framing referenced the invasion of Ukraine as a recent trigger. Three editions later, Nokia's 11th annual Threat Intelligence Report, published in 2025, describes a different threat surface: terabit-scale DDoS attacks are now a daily reality, up from once every five days in 2024; peaks in the 5 to 10 Tbps range are the new normal; 78% of attacks now end within five minutes, up from 44% in 2024, with 37% finishing in under two minutes; and over 100 million residential endpoints, about 4% of the global total, are available for exploitation. The report draws on Nokia's own NetGuard and Deepfield operational telemetry plus survey responses from 160 global telecom security leaders.
The design implication changed with the data. When attacks lasted long enough to page a human, manual response was viable. Against an attack that is over in under two minutes, detection and mitigation have to be automated and sitting in the network path. Nokia's own conclusion is that with "millions of insecure IoT endpoints and organized botnets employing residential proxies," DDoS protection "must be built into the network itself."
The general lesson is worth more than either statistic: IoT is a field where dramatic round numbers circulate for years past their expiry. Before a number goes into your board deck, find the report it came from and check the edition.
How to Scope an Indian IoT App Build So It Ships
The failure mode is rarely technical ambition. Far more often, a team scopes a platform when one workflow was all anybody needed.
- Count the assets, in one week. Meters in your circle, vehicles under permit, machines on the floor, cold rooms in the network. A real number, from your own records. This replaces the market forecast and usually resizes the project.
- Ask what the public rails already give you. For logistics and transport, ULIP, VAHAN, FASTag and AIS-140 backends already carry events you might otherwise instrument. For power, the meter data management system already exists. More than once, the version of "visibility" worth building first turned out to need no new hardware at all.
- Name one decision and one person. Which decision does this app change, who makes it, and how do they make it today? If that cannot be answered in two sentences, the build is not ready.
- Pick connectivity per use case, not per project. Cellular M2M for mobile and dispersed assets, given the coverage the operator data above implies; short-range plus a gateway inside a plant; and NB-IoT or LTE-M where battery life dominates. Mixing is normal.
- Design for the mid-range Android phone. For consumer-facing IoT in India, the target device is not a flagship and the network is not reliable. Offline-first behaviour, small payloads and a functioning degraded state are functional requirements. Our post on how mobile apps are transforming e-commerce in India covers the same constraint from the commerce side.
- Instrument the app, not just the devices. The DISCOM app awareness figures above are what happens when nobody measures whether a feature was found. Feature-level analytics from day one.
- Budget the compliance calendar. MTCTE certification, DPDP data mapping and a CERT-In runbook have lead times that do not compress.
On team shape: this work needs embedded or protocol competence, a cloud and data layer, and mobile, and few Indian businesses outside the product companies hold all three in house. The trade-offs of building that bench versus engaging a partner are the subject of our comparison of dedicated developers versus an in-house team, and the operational side — fleet deployments, staged firmware rollout, observability — sits closer to DevOps practice than to conventional app delivery.
The Honest Counter-Case
Three reasons this opportunity might disappoint a given business, stated plainly.
Hardware margins are gone and software margins are unproven. India's device manufacturing success has commoditised the sensor and the gateway. That helps a software builder, but it also means customers increasingly expect the app bundled free with the hardware. Selling the application layer as a priced product, rather than a giveaway, is still a live commercial question in Indian enterprise IoT.
Public-scheme demand moves on public-scheme timelines. RDSS slipped by two years, to 31 March 2028, at 28% completion. Anyone whose revenue plan assumed the original schedule has already been wrong once. Central sanctions are a strong demand signal and a weak delivery-date signal.
Integration debt is the real cost. In manufacturing especially, machines a decade or two old were not designed to be connected, and the ERP or billing system you must write into was not designed to be read from. The connectivity is usually the easy part; the integration is where the schedule goes.
None of this argues against building. It argues for building one narrow, instrumented workflow against assets you have counted, and expanding from something that already works.
The Bottom Line
India's IoT opportunity is real and it is badly described. Published forecasts for the same market differ six-fold on scope alone, and none of them is what should move a decision. What should is the set of public counters — 137.70 million M2M connections live, and 5.73 crore smart meters installed against 20.33 crore sanctioned — alongside a device manufacturing industry that has already made hardware the easy part.
The unbuilt piece is the application layer — domain-specific, globally the place where value accrues, and in India currently being handed a stream of telemetry that mostly nobody has turned into a decision yet. Count your assets, name the decision, scope one workflow, and build for the phone and network your users actually have.
If you are weighing an IoT build against an instrumented asset base, talk to us — the first conversation is usually about which counter matters, and it is often shorter than expected.
