Setting up an IoT system: device selection, maintenance, data ownership and cybersecurity

The cost of an IoT system is not just the price of the device: installation, maintenance, subscriptions, who ends up holding the data and how secure it is all count. This guide brings together the questions a farmer, cooperative or adviser should ask before setting up a system, and the rules behind them. Architecture and connection options are covered in the guide "The Internet of Things in agriculture".

1. Define the need through the decision

Instead of "let's buy sensors", start with "which decision do we want to make better?": timing irrigation, timing sprays, frost warning? For each decision, write down the variable to measure, how often it must be measured, the alert threshold, and who receives the alert and what they do. For how thresholds work, see the platform's guide on forecasting and early warning. That list becomes the specification that tells you which sensors, how many nodes and what connection you need.

2. Criteria for choosing devices

• Accuracy and calibration: ask in writing for the measurement accuracy stated on the data sheet, the calibration certificate and the recommended calibration interval. Sensors can drift over time; the University of Florida station guide recommends checking for sensor drift as part of maintenance (UF/IFAS, 2015).
• IP rating: the IEC's IP code has two numerals. The first grades protection against solid objects and dust from 0 (no protection) to 6 (no ingress of dust); the second grades protection against liquids from 0 (no protection) to 9 (high-pressure hot water from different angles). The full test conditions are defined in IEC 60529 (IEC). Ask for both numerals, and for devices that will face irrigation, spray or wash water, ask the manufacturer in writing which test the second numeral is based on.
• Open data format and API: the EU Data Act requires connected products placed on the market after 12 September 2026 to be designed so that the data they generate, together with the metadata needed to interpret them, are by default accessible to the user easily, securely, free of charge and in a comprehensive, structured, commonly used and machine-readable format. Before the contract, the seller must tell the user the type, format and estimated volume of data the product can generate, whether data are stored on the device or on a remote server and for how long, and how the user can access, retrieve or erase them (EU, 2023).
• Working when the link drops: ENISA recommends that essential features keep working when communication is lost (ENISA, 2017). For devices such as irrigation valves or pump controllers, ask the seller what happens when the connection drops.
• Updates and support: check that device software can be updated remotely, over a secure connection and with signed packages (ENISA, 2017). The EU Cyber Resilience Act introduces mandatory cybersecurity requirements for products with digital elements; reporting obligations apply from 11 September 2026, the main obligations from 11 December 2027, and compliant products will carry the CE marking (European Commission, CRA).

3. Maintenance schedule

Maintenance intervals from the University of Florida farm weather station guide:

Maintenance covers removing debris and dirt, checking that instruments are level, inspecting mechanisms and bearings for damage, and checking for sensor drift (UF/IFAS, 2015). Add battery level, solar panel cleaning and data gaps to the list.

4. Data ownership and sharing

The EU Code of conduct on agricultural data sharing by contractual agreement, published in 2018 and co-signed by European organisations of the agri-food chain, is not binding but gives guidance for contracts. Its key principles: the right to decide who can access and use the data belongs to the data originator, and the rights to data produced on the farm or during farming operations are attributed to the farmer. Data may be collected, accessed, stored and used only with the explicit, express and informed permission of the data originator given by contract; the contract must not be amended without the data originator's prior consent, and originators should in no way be restricted from transferring their data to another system (EU Code of conduct, 2018). Questions from the code's checklist to ask before signing:

• What data is collected, and who controls access to it?
• Will my data be used for purposes other than providing me with a service, and can I object?
• Is data shared with other parties, and what rules do they follow?
• Can the service provider change the terms unilaterally, and what happens if the company changes hands?
• Can I retrieve my dataset in a usable format, and will my data be deleted when I leave the service?
• Will I be informed of security breaches?

The EU Data Act (Regulation (EU) 2023/2854) made part of these principles binding. Under the Act, which has applied since 12 September 2025, the user of a connected product can request data that cannot be accessed directly from the data holder without undue delay, free of charge, in a machine-readable format and, where relevant and technically feasible, continuously and in real time, and can ask for the data to be made available to a third party of their choice. The data holder may use non-personal data only on the basis of a contract with the user and may not use it to derive insights about the user's economic situation, assets or production methods in a way that could undermine the user's commercial position. The recitals explicitly refer to the Code of conduct on agricultural data sharing and cite, as examples, using a farm's performance data against the farmer when negotiating to buy their produce or feeding it into crop-yield databases for the coming harvest (EU, 2023). The Commission notes that the Act will help farmers analyse real-time information such as weather conditions, temperature, moisture levels, market prices and GPS signals for more effective planning (European Commission, Data Act). The Act applies to manufacturers of products placed on the EU market and to users in the EU; it does not bind a grower in Kozan directly, but it offers a ready template for clauses to put into a purchase contract.

5. Cybersecurity basics

FAO and ITU note that growing reliance on IoT-based sensing in agriculture creates new vulnerabilities, and that introducing rogue data into a sensor network can damage a crop or herd (FAO and ITU, 2019). From ENISA's baseline security recommendations for IoT, the points that can be applied directly in the field are (ENISA, 2017):

• Change default usernames and passwords during initial setup; avoid devices that allow weak or blank passwords.
• Use authentication that is unique per device, and two-factor authentication on accounts where possible.
• Security features should be on by default; disable unused functions and ports.
• Give applications and users only the lowest privilege they need.
• Encrypt communication with standard protocols such as TLS; software updates should be signed and delivered over a secure connection.
• Devices should not be easy to take apart, and stored data should be encrypted.

Checklist: greenhouse and open field

Sources

1. Copa-Cogeca and co-signatory organisations of the agri-food chain, 2018. EU Code of conduct on agricultural data sharing by contractual agreement, summary leaflet (published by CEMA) (accessed 29 September 2026)
2. European Parliament and Council, 2023. Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act) (accessed 29 September 2026)
3. European Commission, Shaping Europe's digital future. Data Act (accessed 29 September 2026)
4. European Commission, Shaping Europe's digital future. Cyber Resilience Act (accessed 29 September 2026)
5. ENISA, 2017. Baseline Security Recommendations for IoT in the context of Critical Information Infrastructures (accessed 29 September 2026)
6. International Electrotechnical Commission (IEC). Ingress Protection (IP) ratings, IEC 60529 (accessed 29 September 2026)
7. Fraisse, C. W. et al., UF/IFAS Extension, 2015 (updated 2018). Your Farm Weather Station: Installation and Maintenance Guidelines (AE502) (accessed 29 September 2026)
8. FAO and ITU, 2019. E-agriculture in Action: Big Data for Agriculture. Bangkok (accessed 29 September 2026)