Short answer: choose an IoT development partner that can own the whole product (hardware, firmware, mobile app and cloud), has shipped connected devices before, builds security in from the start, knows EU rules such as the Radio Equipment Directive and the Cyber Resilience Act, tests on real devices and phones, and gives you full ownership of the code. Ask for references and a clear plan for updates after launch.
An IoT product only works when four layers work together: the device, its firmware, the app and the cloud. Most IoT projects that go over budget fail at the joins between those layers, not inside them. That is why the partner you choose matters more for IoT than for almost any other kind of software. Use this checklist to compare IoT development companies.
The 12-point IoT partner checklist
| # | What to check | Why it matters |
|---|---|---|
| 1 | End-to-end capability: hardware, firmware, app and cloud | One accountable team avoids finger-pointing when a device and app stop talking |
| 2 | Shipped connected products, not only demos | Production devices reveal problems prototypes never show |
| 3 | Connectivity experience: BLE, Wi-Fi, cellular or LoRa | Each protocol changes battery life, pairing, range and app logic |
| 4 | Firmware and over-the-air (OTA) updates | You must be able to fix bugs and security issues in devices already sold |
| 5 | Security by design | Secure boot, encrypted communication and no default passwords are now legal requirements in many markets |
| 6 | Compliance knowledge: CE, RED, CRA, GDPR | Late compliance work causes redesigns and launch delays |
| 7 | Testing on real devices and phones | Bluetooth behaves differently across phone brands and OS versions |
| 8 | Scalable cloud and data design | Costs and reliability depend on how telemetry and device fleets are handled |
| 9 | Clear ownership of code and IP | You need the source code, keys and documentation to stay independent |
| 10 | Transparent process: demos, shared code access, fixed priorities | You see progress every sprint instead of at the end |
| 11 | Support after launch | Phones, operating systems and threats keep changing after release |
| 12 | References you can call | Past clients tell you how the team handles problems |
Swipe the table sideways to see every column.
EU and UK security rules to ask about
Security is no longer optional for connected devices. A good IoT partner should explain how these rules affect your product:
- Radio Equipment Directive (RED) cybersecurity requirements: since 1 August 2025, internet-connected radio equipment sold in the EU must meet cybersecurity, privacy and anti-fraud requirements before it can carry the CE mark.
- EU Cyber Resilience Act (CRA): since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents to ENISA and national authorities, with an early warning within 24 hours. Most other obligations, such as security by design and vulnerability handling for the product's support period, apply from 11 December 2027.
- UK Product Security and Telecommunications Infrastructure (PSTI) regime: since 29 April 2024, consumer connectable products sold in the UK must not use universal default passwords and must publish a way to report vulnerabilities and a minimum security-update period.
- GDPR: applies whenever a device or app processes personal data, which includes most wearables and smart-home products.
Read the official European Commission page on the Cyber Resilience Act for the full text and timelines.
Questions to ask in the first call
- Which connected products have you taken to production, and can we speak to that client?
- Who writes the firmware, the app and the cloud code? Is it one team or subcontractors?
- How do you handle over-the-air updates and rollback if an update fails?
- How do you test Bluetooth or Wi-Fi across different phones and OS versions?
- How will our product meet RED and CRA requirements?
- What do we own at the end of the project?
- What does support cost after launch?
Red flags
- A fixed price before anyone has asked about your hardware, data or users.
- "We only do the app": you will then coordinate firmware and cloud vendors yourself.
- No plan for firmware updates after launch.
- Security and compliance pushed to "a later phase".
- No access to the code or the build until the end of the project.
Example: RyseUp
For a European client, ExtreemTek built RyseUp, a connected wellness ecosystem worth €2 million: iOS and Android apps, desktop apps, BLE and Wi-Fi connectivity, cloud services and an online store, delivered by one team. Read how we work on IoT and connected products and BLE and connected device apps, or see what drives the budget in our IoT product development cost guide.
IoT development partner FAQ
What should I look for in an IoT development company?
Look for a company that can build hardware, firmware, mobile apps and cloud together, has shipped connected products to production, builds security in from the start, understands EU rules such as RED and the Cyber Resilience Act, tests on real devices and gives you full ownership of the code.
Should I use one IoT partner or separate vendors for firmware and the app?
One partner is usually faster and cheaper overall. Separate vendors add coordination time, duplicated testing and slow bug fixing at the boundary between device, app and cloud, which is where most IoT problems happen.
Which security rules apply to IoT devices in the EU?
Since 1 August 2025, internet-connected radio equipment must meet the cybersecurity requirements of the Radio Equipment Directive. The Cyber Resilience Act adds reporting duties from 11 September 2026 and most other obligations from 11 December 2027. GDPR applies when personal data is processed.
How long does it take to develop an IoT product?
It depends on whether hardware already exists. Adding an app and cloud to an existing device can take a few months, while a new product with custom hardware, certification and production usually takes considerably longer. A discovery phase gives a realistic timeline.
Who should own the code of my IoT product?
You should. Make sure the contract gives you the source code for firmware, apps and cloud, plus signing keys, credentials and documentation, so you can change suppliers if you need to.
ExtreemTek newsletter
Get practical IoT and AI engineering tips in your inbox
Guides, checklists and lessons from real product builds. No spam, unsubscribe anytime.
Read our privacy policy.
