Everything worth knowing, nothing that isn't.
What it actually does
An eUICC implements the same authentication and key-storage primitives as a classic SIM — Ki, OPc, IMSI, network authentication — but adds a runtime that can hold multiple operator profiles, each isolated inside its own Issuer Security Domain — Profile (ISD-P). A single eUICC can typically store 5-15 profiles depending on chip size. Only one profile is active at a time on the network. Profile management (download, enable, disable, delete) is controlled by the ISD-R security domain, which is bootstrapped from GSMA-rooted certificates at manufacture.
Why it matters commercially
eUICC unlocks three things impossible with removable SIMs. Device-form-factor freedom (wearables, asset trackers, ruggedized industrial gear no longer need a SIM slot). Logistics simplification (no SIM-card inventory, no factory personalisation per market — devices ship globally and download the right profile at activation). Lifetime cost reduction for IoT (a single eUICC follows the device through every operator-change without a truck-roll or RMA). Combined, this is why every flagship phone since 2018 ships dual-SIM as 1×nano-SIM + 1×eUICC, and why most IoT modules now ship eUICC-only.
Latency, scale, and compliance angle
eUICC profile-switch is a sub-second operation once the profile is installed; a fresh profile download via SM-DP+ takes 4-15 seconds. Hardware compliance is governed by GSMA SGP.05 (eUICC functional spec) and CC EAL4+ or higher Common Criteria certification at the chip level; the OS layer (sometimes called the eSIM OS or eUICC OS) is certified separately. BroadNet's eSIM VSM platform (/operators/esim-vsm) supports every major eUICC silicon vendor (Infineon, ST, NXP, Samsung) and every certified eUICC OS.
Privacy and compliance considerations
The eUICC holds long-term cryptographic secrets that must never leave the chip. Personalisation happens entirely inside the secure element; the SM-DP+ encrypts profile content with a key derived from the chip's certificate so even an attacker with full SM-DP+-to-device network capture cannot recover Ki. SAS-SM audits the path from operator key generation to ISD-P installation; SAS-UP audits SIM-card factories doing the same job for plastic SIMs. See /answers/sas-sm-certification for the audit scope.