ns end-users can access every type of content over the Inter- net, but it is their responsibility to know which content is allowed by laws in that country and which is not. However, each country can apply its own regulation for access to cer- tain content and sites which provide such content (e.g. prohibit certain type of content for given user groups.) For the Internet access service (over broadband and ultra-broadband access), the national regulators may monitor OTT services (e.g. with HTTP QoS metrics, based on measurements with HTTP file upload or download, etc.). To prevent degradation of the Internet access service (e.g. lower bitrates than those specified in the SLA) [2], the national regulatory agency (NRA) in a given country may choose between several regu- latory tools [39], such as setting minimum QoS requirements, and market mechanisms (e.g. through support of competitive markets for the Internet access service providers in that country). In the case of competitive markets, which have no barriers for entry of new ISPs, QoS regulation could be less strict. For cases with barriers to entry (e.g. entry of new mobile operators is dependent upon spectrum availability), more strict QoS regulation can be applied (e.g. mobile operators are required to obtain licenses on frequency spectrum and provide coverage with specified QoS parameters, such as call or message success ratio, voice quality, minimum sustainable bitrates for nomadic and mobile users). The IoT regulatory challenges are primarily targeted to security enforcement and pri- vacy and data protection. However, in this chapter we have defined two main types of IoT services: massive IoT and critical IoT. Massive IoT services (which have existed since the appearance of IP-based access networks, especially with mobile-based Internet access) typically do not require strict QoS regulation, and such services are provided via public 6 Services in Fixed and Mobile Ultra-Broadband Internet access based on best-effort principles. One may say that massive IoT i