The Artificial Intelligence of Things (AIoT) is the combination of Internet of Things devices, meaning sensors and connected products, with machine learning models that interpret the data they collect. The models can run on the device, on a nearby edge computer, or in a remote data center, and that placement shapes delay, data volume, privacy, and security. The U.S. National Institute of Standards and Technology (NIST) published a revised baseline of cybersecurity activities for IoT product manufacturers on April 20, 2026.
Key takeaways
- AIoT is a design pattern, not a single product: connected sensors plus a model that turns readings into decisions or alerts.
- A 2019 survey in the Proceedings of the IEEE describes moving AI to the network edge as a way to use data generated on mobile and IoT devices, and calls the field early-stage.
- NIST IR 8259 Revision 1, published April 20, 2026, supersedes the 2020 edition and covers cybersecurity activities for manufacturers before sale.
- The U.S. Cyber Trust Mark is a voluntary labeling program for consumer wireless IoT products, and the FCC named a new lead administrator on April 13, 2026.
- Where a model runs is a trade-off, and the right answer depends on the use case.
What the term covers
NIST's cybersecurity for IoT program describes IoT systems as connected products and the environments where they are deployed. That covers thermostats, industrial sensors, cameras, medical monitors, and vehicles. A connected device alone is an IoT device. AIoT adds a learned model somewhere in the loop, for example a classifier that flags unusual vibration in a pump or a vision model that counts people entering a store.
The label is used loosely in marketing, so the same word can describe very different systems. A more useful question than "is it AIoT?" is where the data goes, where the model runs, and who is responsible for updates.
Where the model runs
Zhou and colleagues, in a survey titled Edge Intelligence: Paving the Last Mile of Artificial Intelligence with Edge Computing (arXiv, May 2019, published in the Proceedings of the IEEE), note that mobile and IoT devices now generate large volumes of data at the network edge. They argue that AI should move to the edge to make use of it, and they review architectures and frameworks for training and running deep learning models there. The authors describe edge intelligence as an early-stage field. A survey from 2019 does not describe present-day products, but it explains the structure of the choice.
The table below is a simplified orientation. The trade-offs are general engineering considerations, not findings from that survey.
| Placement | What happens | Typical trade-off |
|---|---|---|
| On the device | The model runs on the sensor or camera itself | Little data leaves the device, but the model must be small and updates are harder to deliver |
| Edge computer | A local gateway or server runs the model for many devices | Shorter delay than the cloud and more capacity than a device, with extra hardware to maintain |
| Cloud | Devices send readings to a data center | Large models and easy updates, but dependence on connectivity and more data in transit |
An illustrative data-volume calculation
The numbers here are assumptions chosen for arithmetic, not measurements of any product. A camera streaming video at a constant 4 megabits per second sends about 43 gigabytes in 24 hours. If a model on the camera instead sends only an alert message of roughly one kilobyte when it detects an event, and 50 events occur in a day, the upload is about 50 kilobytes. The gap shows why designers consider local processing for video and audio. It also shows the cost: the on-device model must be accurate enough that missed events and false alarms stay acceptable, and footage that is never stored cannot be reviewed later.
Security guidance for connected products
A model attached to a poorly secured device inherits the weaknesses of that device. NIST's IR 8259 Revision 1, Foundational Cybersecurity Activities for IoT Product Manufacturers, was published in April 2026, with a final version dated April 20, 2026. It supersedes the May 2020 edition. Its abstract says many IoT products lack cybersecurity capabilities that customers need, and it recommends activities manufacturers should consider before products are sold, which can lower the effort and the number of compromises on the customer side. NIST's program page adds that the revision expands guidance on telling customers about maintenance, support, and end-of-life.
For consumers in the United States, the Federal Communications Commission (FCC) oversees the U.S. Cyber Trust Mark, described in the agency's April 13, 2026 announcement as a voluntary cybersecurity labeling program for consumer wireless IoT products. On that date the FCC selected the ioXt Alliance as lead administrator. The announcement does not say when labeled products will reach shelves, and a label would indicate that a product met program criteria, not that every risk has been removed.
Questions to ask about an AIoT product
- Does the model run on the device, at the edge, or in the cloud?
- Which data leaves the device, and how long is it kept?
- How long will the manufacturer provide security updates, and is that period stated?
- What happens to the device's features if the vendor's cloud service closes?
- How are false alarms and missed detections measured and reported?
- Is there a human review step for decisions that affect people?
This article gives general information about technology and public guidance. It is not security, legal, or purchasing advice, and it does not recommend a product.
FAQ
Is AIoT the same as edge AI?
No. Edge AI means the model runs near the data source. AIoT describes IoT devices combined with AI, and the model may run on the device, at the edge, or in the cloud.
Does AIoT require a constant internet connection?
Not always. A model running on the device or a local gateway can work without a connection, although updates, remote monitoring, and cloud features usually need one.
Is there a mandatory U.S. security label for smart devices?
The U.S. Cyber Trust Mark is voluntary, according to the FCC's April 13, 2026 announcement. This article did not verify any separate mandatory labeling rule.
Who writes the security guidance for IoT manufacturers?
In the United States, NIST publishes the IR 8259 series, which recommends activities for manufacturers. Other countries and standards bodies publish their own documents.
Related reading
- AI and robotics
- Characteristics of intelligent agents
- Limited memory AI systems
- AI and cryptography in data protection
More in AI Basics.
Last verified: October 2026
Sources
- Edge Intelligence: Paving the Last Mile of Artificial Intelligence with Edge Computing, Zhou et al., Proceedings of the IEEE, 2019
- Foundational Cybersecurity Activities for IoT Product Manufacturers (NIST IR 8259 Rev. 1), NIST, 2026
- Cybersecurity for IoT Program, NIST, 2026
- FCC selects ioXt Alliance as lead administrator of the U.S. Cyber Trust Mark, Federal Communications Commission, April 13, 2026