How Mobile Apps Impact IoT in 2026: A Build Guide for Connected Products

For most connected devices, the phone app is the screen, the remote and the setup tool. People use it to pair the device, control it, read its data and get its alerts. That means the app decides much of how the product feels: a clumsy app makes a good device look broken. This guide is for founders and product owners who make a device, or want to add one to their product, and need a plan for the app. It covers how the app talks to the device, what iOS and Android ask for in 2026, which security rules now apply, and what the app costs.

Three kinds of connection carry most of these devices. IoT Analytics counted 21.1 billion connected IoT devices in 2025, up 14% in a year, with Wi-Fi behind 32% of connections, Bluetooth 24% and cellular IoT 22% (IoT Analytics, October 2025). Ericsson puts cellular IoT at about 4.5 billion connections at the end of 2025 and expects close to 8 billion by the end of 2031 (Ericsson Mobility Report, June 2026).

What the app does in an IoT product

The app usually has five jobs, and each one is a piece of work with its own cost:

1. Setup: find the device, pair it, put it on the home Wi-Fi or link it to an account.
2. Control: send a command and show that the device obeyed.
3. Data: show readings, history and charts, often from your server rather than from the device.
4. Alerts: push a notice when something happens, even when the app is closed.
5. Sharing: let a family or a team use the same device with different rights.

Many products add a sixth job: delivering firmware updates through the app. Plan it from day one. A device that can’t be updated is hard to keep secure, and the rules below expect you to keep it secure.

Pick the connection before you design screens

How the device reaches the phone shapes every screen, every failure case and your server bill. Most products use one of four routes.

Route	How it works	Works away from the device?	What the app must handle	Good fit
Bluetooth LE, direct	The phone talks to the device within radio range	No, unless the phone or a hub passes data to a server	Pairing, dropped links, syncing data when back in range	Wearables, trackers, accessories
Wi-Fi plus a server	The device sends data to your server, and the app talks to the server	Yes	Wi-Fi setup on first use, accounts, server costs, offline states	Appliances, cameras, sensors that stay in one place
Cellular (LTE-M, NB-IoT, 4G, 5G)	The device has its own SIM and talks to your server	Yes	SIMs and data plans, battery life, server costs	Vehicles, meters, things that move
Matter (smart home)	The device joins the home’s Matter network, and several apps can control it	Through the home hub	Setup next to Apple Home, Google Home and others	Lights, locks, plugs, thermostats, cameras

Our rule of thumb: start with Bluetooth if a person carries the device or stands next to it, and with Wi-Fi plus a server if the device stays at home and people want it from anywhere. Many products end up with both, using Bluetooth for setup and Wi-Fi or cellular for daily use. If you make a home device, read our guide to Matter and smart home apps before you choose.

What iOS and Android ask of an IoT app in 2026

Both platforms have tightened how apps find nearby devices. Both also make setup easier for the user if your app adopts their newer tools.

• On Android, an app that targets Android 12 or later must declare BLUETOOTH_SCAN to look for devices and BLUETOOTH_CONNECT to talk to paired ones. If the app never uses scan results to work out where the phone is, it can mark the scan permission “neverForLocation” and drop the location permission, though Google warns that some beacons are then filtered out of scan results (Android Bluetooth permissions).
• On iPhone, AccessorySetupKit, added in iOS 18, shows a system picker for Bluetooth and Wi-Fi accessories. One tap pairs the accessory to your app and gives the app both Bluetooth and Wi-Fi access to it, and people are not asked for the general Bluetooth permission. Accessories that need a passkey or numeric comparison still show a pairing step (Apple, WWDC24 “Meet AccessorySetupKit”).

So design the first-run flow around these system screens, not around your own. Every extra permission prompt is a place where a new owner can tap “Don’t allow” and give up on setup.

Security rules that now shape the app

Two sets of rules already change what a connected product and its app must do. This is a summary for planning, not legal advice.

• In the UK, since 29 April 2024, consumer connectable products need passwords that are unique per product or set by the user, a published way to report security issues to the maker, and published information on the minimum period of security updates (UK government, PSTI product security regime).
• In the EU, the Cyber Resilience Act entered into force on 10 December 2024. Its reporting obligations apply from 11 September 2026 and its main obligations from 11 December 2027. It sets security requirements for products with digital elements across planning, design, development and maintenance, and makers must handle vulnerabilities for the product’s whole life (European Commission, Cyber Resilience Act).

For the app, that means concrete work: a step in setup where the owner sets their own credentials, a way to deliver firmware updates, a visible security contact, and a record of which device runs which version. Put these in the first release. Adding them later means reworking the setup flow when people already use it.

What we learned on our device projects

On PIX, the client already had a working LED backpack and needed an app for it in time for Web Summit. We built the app in React Native and connected it to the backpack over Bluetooth 4.0 LE, with image and video transfer and an auto-save of every new drawing or animation. PIX later raised $150,000 on Kickstarter against a $35,000 goal.

On Project Steps, the sensor was the phone itself. The iOS app reads step counts from Apple HealthKit and turns activity into points that unlock discounts at local businesses. It went from the client’s first call to the App Store in 1.5 months.

In both projects the hardware side already worked, and our job was the app and the link to it. If your device already works, test that link with real hardware in the first week, before you polish a single screen.

What the app costs and how we would estimate it

Our published price for a first version of an app is $5,000-15,000, typically 2-4 weeks plus store review, at $39-55 an hour (mobile app development). For comparison, across 95 agencies the median published MVP starting price is $13,234 and the median promised timeline is 6 to 12 weeks (Rocketech MVP Price Index 2026, H2 edition). Those are published prices, not what agencies charge after scoping. An app budget also leaves out the hardware, the firmware and any device certification, so ask who owns each of those before you compare quotes.

To get a range for your own product, run your idea through our project estimate. It works in four steps:

1. You describe the device and the app in a short brief.
2. The estimate turns the brief into user stories, such as “pair the device in one tap” or “see last week’s readings”. You confirm what is in scope, and every hour in the budget traces back to a story you kept.
3. We check the hours the model suggests against what our team actually books on finished projects, then multiply by our published rate of $39-55 an hour.
4. You get an hours range, a budget range and a number of weeks. It is a planning range, not a fixed quote.

If you also ask for the market view, the estimate suggests customer groups and gives each one a market size (TAM, SAM and SOM) with a note on what the number covers. Treat those as hypotheses to test, not verified demand.

What we would do

1. Write down where the device lives and who carries it. That picks the connection route.
2. Get two or three working units, or a development board with the same radio, before app work starts.
3. Build pairing and the first-run flow first, on AccessorySetupKit for iOS and the Android 12 permissions.
4. Decide what data stays on the device, what goes to your server, and for how long.
5. Put the security basics into release one: owner-set credentials, an update path and a security contact.
6. Ship setup, control, one data screen and alerts. Add history, sharing and automations after real owners have used it for a few weeks.

FAQ

How do mobile apps connect to IoT devices?

Most use Bluetooth Low Energy when the phone is near the device, or Wi-Fi with a server so the app works from anywhere. Devices that move often carry their own cellular connection. Smart home devices increasingly use Matter, which lets several apps and home platforms control the same device.

How much does an IoT mobile app cost?

Our published price for a first version is $5,000-15,000, typically 2-4 weeks plus store review. Across 95 agencies, the median published MVP starting price is $13,234 (Rocketech MVP Price Index 2026, H2). Hardware, firmware and device certification are separate costs.

Do I need my own server for an IoT app?

Not if the app only talks to the device over Bluetooth while the owner is nearby. You need a server once people want to see data or control the device from somewhere else, share it with others, or keep a history.

What security rules apply to a connected device and its app?

In the UK, the PSTI rules have applied since 29 April 2024: passwords unique per product or set by the user, a way to report security issues, and a published minimum security update period. In the EU, the Cyber Resilience Act’s reporting obligations apply from 11 September 2026 and its main obligations from 11 December 2027. Check your own product with a lawyer.