The Agency and the European Supervisor analyse the benefits and challenges of federated learning to train AI models

(10 June 2025). The Spanish Data Protection Agency (AEPD) and the European Data Protection Supervisor (EDPS) have published a joint report analysing the key role of Federated Learning as a tool to advance artificial intelligence models that are more respectful of the protection of personal data. 

The growing need to process large volumes of data has led to the development of technologies such as federated learning, which allows AI models to be trained using decentralised data. This technology is strategic at a time when organisations seek to balance technological innovation with data protection compliance.

The federated learning means that the models are trained locally on each device or entity and only the result is shared, without the need to send the original data to a central server. This feature contributes to mitigating privacy risks, especially in key scenarios. Among the most prominent use cases in the report are the development of AI models in the health sector – with particularly sensitive data – as well as in voice assistants and autonomous vehicles.  

The Land Learning aligns with data protection principles such as purpose minimisation and limitation by ensuring that the information remains under the control of the controller and is not exposed to third parties. In addition, it improves compliance with the accountability and auditability of treatments. 

On the other hand, Land learning is considered a dual-use technology, both for the protection of privacy and for boosting the digital economy. Thus, effective data governance contributes to enabling various entities to collaborate in the training of AI models, including with data that, by their nature estrategical, sensitive or confidential, would never be shared otherwise. The report also highlights the challenges faced by Federated Learning. 

The report underlines the need to implement comprehensive security across the federated learning ecosystem and to ensure data quality, avoiding biases. In this regard, the report shows that it is essential not to assume that the parameters exchanged or the resulting models are anonymous without a thorough technical and legal analysis.

To maximise the potential of federated learning, the report emphasises the importance of adopting an approach that prioritises data protection by design. This involves implementing solutions for data processing that reduce the risk to individuals, allow access to data and increase trust for different actors to enter the digital economy.

Other technology innovation documents published together with the EDPS:

• TechDispatch: Neurodata
• 10 misunderstandings related to machine learning
• 10 misunderstandings related to anonymisation
• Technical Note: 14 misunderstandings regarding biometric identification and authentication
• Introduction to the hash as a pseudonymisation technique for personal data