Managing risks in IoT-enabled smart cities: a fuzzy multi-criteria decision-making approach

Purpose To identify and explain the critical risks that impede Internet of Things (IoT) adoption in smart cities, reveal their causal interdependencies and propose a prioritized roadmap to support data-driven urban decision-making. Design/methodology/approach A hybrid fuzzy multi-criteria decision-making framework integrates Fuzzy DEMATEL and Fuzzy TOPSIS using expert inputs from academia, government and industry. DEMATEL maps cause–effect relationships among risks; TOPSIS ranks them by severity, likelihood, controllability and sustainability. Findings Infrastructure limitations, cybersecurity vulnerabilities and regulatory gaps emerge as dominant causal risks. Dependent risks, including public trust and technological complexity appear downstream. The combined analysis directs attention to strengthening infrastructure, instituting robust cybersecurity frameworks and enhancing governance mechanisms. Research limitations/implications Results reflect expert judgments within the study's context; generalizability may be constrained. Future research could validate the model with multi-city datasets, longitudinal evidence and comparative analyses of alternative MCDM techniques. Practical implications The study delivers a ranked, actionable risk-mitigation agenda to guide resource allocation and policy design for urban administrators and policymakers. Social implications Mitigating foundational risks can bolster citizen trust, resilience, and inclusive digital transformation in smart cities. Originality/value By combining causal mapping (DEMATEL) with prioritization (TOPSIS), the study advances IoT risk management in smart-city contexts and offers a replicable tool for strategic governance.