Today, the expansion of the Internet of Things (IoT) and its growing role across various sectors has led to the emergence of a spectrum of novel crimes for which traditional criminal law frameworks are not fully capable of providing adequate responses. In Iran, the legislator has primarily focused on human conduct in cybercrimes, while crimes arising from automated system operations or failures in connected systems lack a clear framework regarding the identification of the perpetrator, mens rea, and criminal liability. The aim of this study is to explain Iran’s legislative criminal policy toward crimes related to the Internet of Things in light of international instruments. The present research is theoretical in nature and employs a descriptive-analytical method. The findings indicate that although Iranian laws cover certain aspects of IoT-related crimes—particularly direct attacks against systems or the use of connected devices as instruments for committing crimes—they face serious gaps when dealing with crimes resulting from automated decision-making by systems, particularly in terms of specific criminalization, determination of criminal liability, and establishment of the mental element. National instruments, such as the Resolution on IoT Requirements and the Guidelines for Connected Vehicles, despite their preventive function, lack criminal enforcement guarantees. Therefore, Iran’s legislative criminal policy requires structural revision, updating of traditional legal rules, and alignment with international instruments and standards to effectively address this category of crimes, strengthen criminal protection in the field of IoT, and enhance public trust in emerging technologies and user security.