The race to generative artificial intelligence has a well-known paradox: to train or fine-tune powerful models you need huge amounts of data, but in regulated sectors that data cannot leave corporate boundaries. Basque startup Sherpa.ai has just secured $18 million to show that the paradox can be resolved, by bringing training directly to the data, without ever moving it.

The round includes new investor Forgepoint Capital, a Silicon Valley venture capital firm focused on cybersecurity and AI, and existing backers Mundi Ventures, Ekarpen, Allegra Holdings and SETT. The goal is to accelerate development of a platform designed for enterprises and governments that want to leverage Large Language Models without surrendering data sovereignty.

Sherpa.ai has already signed contracts with organizations including Indra, the US National Institutes of Health, Centogene Genomics, Caja Laboral, Unicaja and Prosegur, spanning healthcare, finance, industry and the public sector. The common thread is the need to operate in environments where regulatory constraints (from GDPR to healthcare data rules) make generic cloud APIs impractical.

The company's platform relies on federated learning and privacy-preserving techniques, enabling multiple organizations to train models collaboratively without sharing the original datasets. In practice, each node keeps data on its own servers: the model travels, the data stays put.

On the research front, Sherpa.ai is validating the approach with peer-reviewed publications. A recent study, Towards the Next Frontier of LLMs, Training on Private Data: A Cross-Domain Benchmark for Federated Fine-Tuning, explores how to fine-tune LLMs on distributed, private datasets. Another collaboration with the NIH and University College London applied federated learning to rare disease diagnosis. And work on Blind Federated Learning showed how to reduce communication between nodes by up to 99 per cent, cutting network costs and making federated training more practical at scale.

For those evaluating on-premise or hybrid deployments, these developments signal that fine-tuning language models on sensitive data is moving beyond the experimental phase. Federated architectures, combined with quantization and compression techniques, are narrowing the gap to the point where a company can train an LLM on its own data without having to upload it to an external cloud, retaining full control. Trade-offs remain: communication efficiency and the added computational cost versus centralized training, the orchestration complexity of multiple nodes, and the need to ensure model quality doesn't suffer from data distribution. But the direction is clear. AI-RADAR delves into these deployment choices with dedicated analysis, for those who need to balance sovereignty, performance and Total Cost of Ownership.