For most of the past decade, federated learning lived mostly in academic studies and one-off pilots. Today, confidential computing, more capable models, and production-ready platforms let organizations train and run AI on sensitive data that never leaves their environment. Federated networks already operate at scale across healthcare and life sciences.
So, what separates a successful pilot from a lasting program? Chris Laws, Rhino’s Chief Commercial Officer, took on that question in a recent webinar hosted by The AI Summit Series by Informa. Working with roughly 200 organizations has taught Rhino where projects tend to stall. The fastest ones build trust early, settle incentives upfront, and plan for the people and processes around the platform. The discussion during the webinar distilled that experience into six lessons.
How to Ensure Federated Learning Pilots Reach Production
The technology is rarely what holds a federated project up, especially when privacy and security are built into the platform. Pilots stall on what surrounds it, such as legal review, unclear incentives, inconsistent data, fuzzy ownership, infrastructure gaps, and untraceable agents. In Rhino’s recent customer conversations, over 90% of organizations raised governance and permissions, more than any other topic. In some projects on the Rhino Federated Computing Platform (Rhino FCP), the legal agreements took longer than all the technical work, and then the software deployed in a day.
The six lessons below follow the points where pilots most often get stuck. Each pairs a common obstacle with what teams that reached production did differently.
1. Build Trust Before You Build Anything Else
Bring legal, privacy, and security teams in at the start. A project that surprises a stakeholder a month in usually stops cold. Show counsel successful case studies, walk them through the controls, and explain the business value. Code pre-approval helps too, because data owners can review every line of code before it touches their data. When those controls are built into the platform, legal review moves quickly, because counsel is confirming safeguards that already exist.
2. Make Incentives Explicit
Many pilots start because smart people get access to a new tool and want to see what it can do, or they want to publish a paper. Production programs need clear answers about who pays for compute, who contributes data, who owns the resulting IP, and what each contributor gets back, whether that's academic credit, IP, or revenue.
Lilly TuneLab gets this exchange right. The platform gives smaller biotechnology companies and external partners access to predictive AI/ML models built from over $1 billion worth of Lilly's proprietary research data, preclinical datasets, and experimental drug molecules. Partners help improve those models by letting Lilly train on their data, which never leaves their environment. That fair trade has drawn more than 140 partners to the network.
3. Harmonize Data Across Every Participating Site
Two hospitals can both use a common data model like OMOP and still record the same concept differently, because each one collects, cleans, and validates its data in its own way. Few teams have the data engineers to spend months reconciling those differences, so successful programs agree on data standards and minimum data volumes before any participant joins. Once the program is running, those standards have to hold up as new data arrives, which is where Rhino's Data Harmonization Engine (DHE) comes in. The DHE recommends mappings with an LLM, sends them to a data expert for review, and turns the approved mappings into a production pipeline.
4. Decide Who Controls What Runs on the Data
Every federated program needs clear answers about where software gets deployed, what code can run on each dataset, and who is allowed to run it. A steering committee or business owner should own those decisions, along with the strategic agenda behind them, such as which models to train and which agents to deploy. Rules on paper only go so far, though. Successful programs also enforce permissions in the platform itself, so each data owner controls exactly what runs on their data, and one misconfigured setting can't expose patient records or burn thousands of dollars in GPU compute. In the webinar, Chris described it as trusting your partners while still being able to verify.
5. Line Up Compute and Infrastructure Before Training Starts
Data scientists know how to build models and solve hard data problems, but most aren't infrastructure engineers, and federated projects put heavy demands on infrastructure. GPUs are scarce, so teams need to confirm one will be available before scheduling a training run.
Every partner site also has to stay online for the length of the job, since a single server switched off for the weekend can fail training for everyone. Programs that reach production line up compute and coordinate across sites in advance, which frees data scientists to focus on the models instead of troubleshooting cloud instances.
6. Make Agent Actions Traceable
Agents raise the stakes on governance. In regulated industries, teams need to show a regulator exactly what an agent did, what data it touched, and why, ideally in a way they can repeat.
During the webinar, Chris ran a live poll asking attendees how confident they would feel showing a regulator that record. Most said they weren't running agents yet, and those who were reported low confidence in their ability to trace them. Traceability starts with running agents where the data lives and logging every step they take, so each action ties back to an approved workload. That groundwork, like every lesson above, depends on having the right people and decisions in place before launch.
How to Get Your Organization Ready for Federated Learning
Chris closed the session with a takeaway that sums up all six lessons. "The technology to send code to the data is ready, so the people that win will be the ones that get their people ready first."
Many organizations aren’t there yet. In Rhino’s recent customer conversations, more than half said some version of “we’re not ready on our side,” meaning no internal owner, no team, and no defined scope. Getting your people ready starts with the right group in the room, including an executive sponsor, the data owner, legal counsel, privacy and security officers, and a domain expert who can judge whether the results hold up. Together, that group should settle a few questions before any code runs:
- What data do we need, and who holds it?
- What does each party contribute and get back, and who pays for compute?
- Who approves the code, models, and agents that run on the data?
- Who runs the program day to day?
Teams that answer these questions upfront reach production faster, because the hard conversations happen before launch instead of halfway through a pilot.
To hear the full discussion, watch the webinar on demand. If you're ready to plan your first federated project, schedule a call with our team today.
Frequently Asked Questions
Does Federated Learning Work Across Silos Inside One Company?
Yes. Enterprises use federated learning when business units in different countries can't pool data, when moving data between clouds would rack up egress fees, or when acquisitions have left data scattered across teams. Rhino Data Activation, built on the Rhino FCP, makes that data ready for AI wherever it lives.
How Does Federated Learning Handle Different Privacy Regulations?
Federated learning keeps raw data at each site, which makes regulations like GDPR and HIPAA easier to satisfy, though each data custodian still decides what compliance requires. The Rhino FCP is HIPAA and GDPR-compliant and gives teams several controls on top of that. Sites can de-identify data before or after connecting it to the platform, set field-level permissions on sensitive data, and tune differential privacy budgets to their own accuracy needs.
How Long Does It Take to Deploy Federated Learning?
Installing the Rhino FCP takes less than 10 minutes. A typical deployment takes two to four weeks. Most of that timeline goes to information security review and hardware provisioning, so teams that bring security, legal, and IT in early tend to launch fastest.
