ISO/IEC 7816 Smart Card Standard: Parts 1-4 Explained

Home / Developer Resources / ISO/IEC 7816 Smart Card Standard: Parts 1-4 Explained

ISO 7816 Smart Card Standard

ISO/IEC 7816 is the multi-part international standard that defines how a contact integrated-circuit card and a terminal physically fit together, electrically talk to each other, and exchange application data. If you are building or integrating a contact smart-card product, this family is the reference you design against.

A common source of confusion is worth settling first: ISO/IEC 7816 covers cards with contacts. Contactless proximity cards are specified by ISO/IEC 14443, and vicinity cards by ISO/IEC 15693. Many modern dual-interface products implement 7816-4 command structures over a 14443 contactless link, which is why the two families are so often seen together.

Which part answers which question

The series is split so that mechanical, electrical and logical concerns can evolve independently. In practice engineers reach for a different part depending on the problem in front of them:

  • Part 1 – Physical characteristics. Card body, durability, and environmental tolerance. Relevant when you are choosing card stock or qualifying a manufacturing process.
  • Part 2 – Dimensions and location of the contacts. Where the contact pads sit and how large they are, so that any compliant card works in any compliant reader.
  • Part 3 – Electrical interface and transmission protocols. Voltage classes, clock, reset behaviour, the Answer to Reset (ATR), and the T=0 and T=1 transmission protocols.
  • Part 4 – Organization, security and commands for interchange. The logical layer: APDU structure, file organisation, access conditions, secure messaging and application selection. This is the part most application developers spend their time in.
  • Part 5 – Registration of application providers. How application identifiers (AIDs) are made globally unique.
  • Part 6 – Interindustry data elements for interchange. Common data element definitions and their tags.
  • Part 8 – Commands and mechanisms for security operations. Cryptographic operations layered on the Part 4 command set.
  • Part 9 – Additional interindustry commands and security attributes. Card and file management commands.
  • Part 15 – Cryptographic information application. A standard way to describe the keys and certificates a card holds.

Editions move, and it matters

The parts are revised on independent schedules, so “ISO 7816” on its own is not a precise citation. Part 4 in particular has been through four editions; the current one is ISO/IEC 7816-4:2020, and its title changed along the way from the older Interindustry commands for interchange to Organization, security and commands for interchange. Part 3 has an amendment adding voltage classes and a further revision in progress.

If you are writing a compliance statement, a test plan, or a procurement requirement, cite the part and the edition year. A reference to a superseded edition is a common and avoidable review finding.

How Ambimat uses the series

In our smart-card and payment engineering work these parts are design inputs rather than reading material. Part 3 governs what the reader hardware and the driver stack must tolerate; Part 4 governs the command set the applet exposes and the file layout behind it; Parts 5 and 6 govern the identifiers and data elements that let a card interoperate outside a single vendor’s ecosystem. Scheme specifications such as EMV sit on top of this base and add their own constraints rather than replacing it.

The pages in this section are Ambimat’s own engineering explanations of these topics, written to help developers get productive quickly. They are explanatory material, not a substitute for the standard.

Authoritative source

ISO/IEC 7816 is published by ISO and is a copyrighted work. For the normative text, obtain the relevant part directly from ISO: