For most of the past three years, private 5G networks—formally known as non-public networks, or NPNs—were treated as experiments. Enterprises ran pilots in a single warehouse or factory hall, system integrators absorbed the integration cost, and mobile operators watched from the sidelines. In 2026 the balance has shifted: more facilities are moving into their second and third production sites, and the discussion is no longer about whether a private network works, but about how to deploy it repeatably and economically.
At the centre of that shift is the customer-premises equipment (CPE) that terminates the private network inside the facility. A device that was fine for a 12-month trial often becomes the bottleneck when the deployment has to scale across dozens of sites, hundreds of devices, and a mix of SIM-based and credential-based onboarding. This post summarises what telecom buyers—system integrators, enterprises and operator enterprise units—should now expect from NPN-grade CPE.
From proof-of-concept to production-grade NPN
Early private 5G builds were dominated by lab-grade radios and borrowed consumer or consumer-adjacent gateways. As deployments mature, three requirements separate a production NPN from a trial: deterministic availability, centralised device management, and a clear path for firmware and security updates. A gateway that cannot be remotely diagnosed, reconfigured or upgraded becomes an expensive field-service call at every one of fifty sites.
Buyers are therefore standardising on CPE that supports standard management planes such as TR-069 or the newer TR-369 (USP), secure over-the-air firmware updates, and SNMP or REST-based monitoring for integration into existing NOC tooling. The days of managing a private network from a vendor’s single-purpose cloud console are ending for anything beyond a single site.
What changes in CPE requirements at scale
At scale, three cost and operational realities dominate:
- Zero-touch provisioning. Shipping a pre-configured gateway to every site is unsustainable. Production CPE should support zero-touch onboarding, where the device fetches its configuration from a provisioning server after authenticating with a certificate or eSIM profile.
- Industrial hardening. Private networks increasingly terminate in environments with dust, vibration and wide temperature ranges. DIN-rail mounting, extended temperature ratings and dual-SIM failover are becoming baseline asks, not premium options.
- Band and spectrum flexibility. A private network may use locally licensed spectrum, shared spectrum such as CBRS-style n48 bands, or operator-licensed bands. CPE must support cell selection and band configuration appropriate to the regulator and the deployment.
SNPN vs PNI-NPN: how the deployment model shapes the CPE
3GPP defines two main NPN models. A standalone non-public network (SNPN) is fully self-contained, with its own core and identity; the enterprise or integrator typically owns the whole stack. A public network integrated NPN (PNI-NPN) is a slice or closed access group (CAG) inside a public operator’s network. The two models place very different demands on CPE.
In an SNPN, the CPE must work without a public SIM, authenticating to a private core using credentials or an eSIM profile issued by the enterprise. In a PNI-NPN, the device must correctly handle CAG cell selection so it only camps on authorised cells, while still being able to fall back to the public network where the operator allows it. A buyer should confirm which model the deployment targets before locking in a device SKU.
RF, spectrum and cell-selection considerations
Private 5G spans a wide spectrum range: sub-1 GHz bands for coverage in mines and ports, mid-band 3.4–3.8 GHz and n48 for capacity, and millimetre-wave for high-throughput industrial zones. CPE antenna design must match the use case—outdoor or industrial units may need external antenna ports for directional coverage, while indoor gateways prioritise integrated MIMO antennas.
Carrier aggregation and band-locking matter here as much as in public FWA. A facility that aggregates a mid-band private carrier with a licensed anchor can materially improve uplink performance for vision and sensor workloads, which are often uplink-heavy rather than downlink-heavy.
Device management, security and zero-touch provisioning
Security is the fastest-growing criterion in NPN procurement. Because private networks carry operational data that is frequently more sensitive than consumer traffic, buyers now ask for hardware root of trust, secure boot, encrypted configuration, and certificate-based device identity. eSIM and iSIM are gaining ground because they allow remote provisioning of private-network credentials without physical SIM handling at each site.
A practical NPN CPE evaluation checklist
- Deployment model confirmed: SNPN, PNI-NPN (CAG), or both
- Band support matching licensed or shared spectrum in the target region
- Zero-touch provisioning and certificate or eSIM-based onboarding
- TR-069 / TR-369 USP management and secure FOTA
- Industrial enclosure, mounting and temperature rating where required
- Dual-SIM or multi-PLMN failover for resilience
- Documented security posture: secure boot, root of trust, encrypted config
Private 5G has crossed the threshold from novelty to operational tool. The CPE that terminates it is no longer an afterthought—it is the difference between a network that scales and one that stays stuck in pilot mode.