In an era where artificial intelligence promises transformative power across industries, a fundamental tension persists: the hunger for data-driven insights clashes with the growing imperative to protect privacy and maintain data sovereignty. Sherpa.ai, a startup based in the Basque region of Spain, has positioned itself at the center of this conflict, announcing an $18 million fundraising round to scale its approach to AI that never sees raw data. The investment, led by Silicon Valley's Forgepoint Capital along with existing backers Mundi Ventures, Ekarpen, Allegra Holdings, and SETT, signals a strong vote of confidence in a model that prioritizes privacy without sacrificing performance.
The Federated Learning Revolution
At the core of Sherpa.ai's technology lies federated learning, a machine learning technique that inverts the traditional data pipeline. Instead of collecting massive datasets into a central repository — a process fraught with privacy risks, legal hurdles, and logistical challenges — federated learning brings the model to the data. Each participating organization, whether a hospital, bank, or government agency, trains the model locally on its own sensitive records. Only the resulting model updates, stripped of any raw data, are shared and aggregated to improve the global model. Sherpa.ai claims its research can reduce the amount of data transmitted between sites by up to 99 percent, a staggering efficiency gain that also bolsters security.
This approach is particularly appealing in regulated sectors where stringent data protection laws like Europe's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) impose severe penalties for mishandling personal information. Traditional AI projects often stall because organizations cannot legally or ethically pool sensitive data. Federated learning offers a path forward, enabling insights from patient records, financial transactions, or classified government data without exposing the underlying information. Xabi Uribe-Etxebarria, founder and CEO of Sherpa.ai, articulated the company's mission succinctly: to let organizations “harness the full potential of AI without giving up control, privacy and sovereignty over their data.”
Addressing the Sovereign AI Imperative
The term "sovereign AI" has become a buzzword in technology circles, but Sherpa.ai's approach gives it concrete substance. Rising geopolitical tensions and a wave of data localization laws — from China's Cybersecurity Law to India's proposed Data Protection Bill — have made it imperative for companies and governments to keep sensitive data within national borders. The European Union's push for digital sovereignty, epitomized by projects like Gaia-X and the European Health Data Space, has created a fertile market for solutions that promise AI capabilities without data exfiltration. Sherpa.ai's technology directly addresses these concerns by ensuring that raw data never leaves its place of origin, even while models benefit from collective learning across multiple sites.
The client list reflects this sovereign AI ethos. Sherpa.ai has recently signed contracts with Spain's Indra, a major defense and IT contractor, as well as Caja Laboral and Unicaja, two prominent Spanish banks. Security group Prosegur, genomics firm Centogene, and the US National Institutes of Health (NIH) have also partnered with the company. The NIH deal is particularly noteworthy: a European startup specializing in privacy-first AI selling its services to a US federal agency underscores the universal appeal of data sovereignty. It also demonstrates that the technology can transcend regional biases, working effectively within the strict regulatory framework of the United States.
Research Backing and Industry Validation
While federated learning is not a new concept — Google famously used it to improve keyboard predictions on Android without uploading user typing data — Sherpa.ai has invested heavily in peer-reviewed research to differentiate its offering. The company has published academic papers on training large language models (LLMs) across private datasets, a complex technical challenge that involves coordinating distributed computation while maintaining model accuracy. It has also collaborated with the NIH and University College London to apply federated learning to rare-disease diagnosis, where data scarcity often hampers AI development. By aggregating insights from multiple medical institutions without sharing patient records, the technique can accelerate the identification of patterns in small, scattered datasets.
This research pedigree lends credibility to Sherpa.ai's claims, especially as the market for sovereign AI grows crowded. National projects like France's Mistral AI or Germany's Aleph Alpha are building foundation models with explicit government backing, while a host of privacy-focused startups — ranging from encrypted computation firms to differential privacy toolkits — vie for the same customer base. Amid this competition, Sherpa.ai's focus on federated learning as a practical, deployable solution, rather than a theoretical promise, gives it an edge. The $18 million raise, while modest compared to the billions flowing into generative AI, is a strategic bet on a sustainable niche.
Market Dynamics and Future Prospects
The demand for data-sovereign AI is only expected to grow. Regulatory trends are tightening: the EU's AI Act, which introduces risk-based rules for AI systems, will impose additional compliance burdens, particularly for high-risk applications in healthcare, finance, and law enforcement. Similarly, the US has seen a flurry of executive orders and proposed legislation aimed at safeguarding sensitive data from foreign adversaries. As these frameworks solidify, organizations will seek technologies that allow them to leverage AI without running afoul of the law. Sherpa.ai's federated learning model is inherently compliant with many of these requirements, offering a path to AI adoption that minimizes legal risk.
From a business perspective, the company's focus on vertical markets — banking, healthcare, government — ensures recurring revenue streams from long-term contracts. These sectors are characterized by high switching costs and deep regulatory moats, making them sticky customers once a pilot project succeeds. Sherpa.ai's partnerships with established players like Indra and Prosegur also provide distribution channels and credibility when pitching to other conservative buyers.
The competitive landscape, however, is not static. Tech giants like Google, Microsoft, and Amazon are investing heavily in confidential computing and privacy-preserving ML techniques, potentially bringing their vast resources to bear on the same problem. Yet their core business models rely on cloud services that inherently centralize data, creating a conflict of interest that Sherpa.ai can exploit. By offering an on-premises or hybrid deployment option that never transfers raw data to the cloud, the startup can appeal to organizations that are wary of vendor lock-in or data exposure.
Technical Deep Dive: How Sherpa.ai's Federated Learning Works
To appreciate Sherpa.ai's innovation, it helps to understand the mechanics of federated learning in a production environment. The process begins with a global model — often a neural network or a large language model — that is distributed to each participating node, such as a hospital's server or a bank's secure enclave. Each node trains the model on its local data for a specified number of epochs, then sends only the gradient updates (the parameter adjustments that improve the model) back to a central server. The server aggregates these updates, typically using an algorithm like Federated Averaging (FedAvg), and updates the global model. Crucially, the raw data never leaves the node, and the central server has no access to it. Differential privacy can be layered on top to further obscure individual records from the gradient updates.
Sherpa.ai has optimized this process for the specific needs of large language models, which are notoriously data-hungry and computationally intensive. Its research addresses challenges like communication efficiency (reducing the number of rounds needed), heterogeneous data distributions (handling the fact that different hospitals may have very different patient populations), and security against adversarial attacks that might try to infer sensitive information from model updates. The company also provides a platform that manages the orchestration of federated training runs, including encryption, authentication, and compliance logging.
This technical sophistication is essential for selling to regulated industries. Banks and hospitals not only need to see that the technology works, but also that it meets audit and certification requirements. Sherpa.ai's published research and partnerships with academic institutions help build that trust. The company's involvement with the NIH's rare-disease project, for example, involved rigorous validation of the federated model against traditional centralized training, demonstrating that distributed learning could achieve comparable accuracy without compromising privacy.
As the AI landscape continues to evolve, the line between data utility and privacy will only become more contested. Sherpa.ai's $18 million raise is a bet that organizations will increasingly choose solutions that respect data borders — not merely out of compliance, but out of strategic necessity. The next few years will reveal whether that bet pays off, but the company has already established itself as a credible player in a market that is rapidly defining the future of enterprise AI."