France's PEPR Santé Numérique programme faces the same architectural problem as every serious federated health data initiative in the world — and it is building the infrastructure to solve all the adjacent problems without yet addressing it.
The problem is this: when a federated AI system at one node produces a validated clinical finding, where does that finding go?
PEPR Santé Numérique, running from 2023 to 2030 with €60 million in national priority funding, has assembled an impressive federated research infrastructure. Eleven Inria research teams work on distributed and federated machine learning approaches through the FedMalin initiative. AP-HP's Entrepôt de Données de Santé (EDS) covers 19 million patients across 39 Paris hospitals. The Health Data Hub is migrating to SecNumCloud-EU hosting in alignment with France's health data sovereignty mandate and the European Health Data Space. INSERM coordinates multi-site clinical research across institutions that cannot share raw patient data.
What none of this infrastructure currently provides: a mechanism for validated clinical outcomes to travel — stripped of patient identity, encoded as compact packets — from the node where the intelligence was generated to the nodes across the PEPR network, across France, and across European federated health data initiatives, that are working on the same class of clinical problem.
That gap is architectural. And it has a precise solution.
What PEPR Santé Numérique Is Building
France's approach to federated health data is among the most systematic in Europe. The PEPR programme is not a single project — it is a coordinated research agenda that spans several distinct but interconnected workstreams.
FedMalin (Federated Machine Learning) coordinates 11 Inria research teams working on privacy-preserving distributed AI. The approach is explicitly federated: each node retains its data, algorithms run locally, and only aggregated or transformed outputs are shared. This is sound methodology for training machine learning models across distributed sensitive datasets.
AP-HP EDS provides one of the richest single-institution health data environments in the world. Nineteen million patients, 39 hospitals, longitudinal electronic health records across surgical, oncological, cardiology, and psychiatric services. The architecture centralises within the AP-HP network while complying with French and European data governance frameworks.
Health Data Hub is France's national platform for health data access, migrating to SecNumCloud-EU infrastructure as part of France's digital sovereignty agenda. The Hub facilitates approved researcher access to linked health datasets while maintaining GDPR compliance and French data residency requirements.
INSERM multi-site research connects clinical research institutions across France, coordinating studies that require cross-institutional data access under formal data access agreements.
The common thread across all of these: federated access to data, privacy-preserving computation, distributed research infrastructure. The missing thread: routing what the computation produces.
The Open Loop in French Federated Health AI
Consider a concrete scenario within the PEPR architecture.
An Inria research team at FedMalin, working with an AP-HP hospital in Paris, trains a federated model on patients with a rare oncological presentation. After validation, the model identifies a treatment sequence that improves progression-free survival in a specific cytogenetic profile. This is a real clinical finding — validated, specific, significant.
Where does this finding go?
Within the AP-HP EDS, it may propagate through internal research channels. If a researcher at a different AP-HP hospital submits the right query, they might find it. But the INSERM multi-site research network that includes a centre in Lyon treating similar patients? A FedMalin partner institution working on the same cytogenetic profile? A hospital in Belgium participating in a cross-border EU rare disease network? These nodes do not receive the validated finding. The intelligence stays at the institution where it was produced.
This is not a failure of PEPR's architecture. FedMalin was designed to federate training, not to route outcomes. AP-HP EDS was designed to provide centralised access within the AP-HP network, not to distribute distilled findings outward. The Health Data Hub facilitates access to data, not transmission of what the data proved. The open loop is in the layer that none of these systems was designed to fill.
The clinical cost of this gap is measurable. France has 39 AP-HP hospitals generating treatment outcome intelligence simultaneously. If none of those outcomes route to the other 38 hospitals by semantic similarity, the network of 39 is producing the intelligence of 1. At N=39 hospitals: N(N-1)/2 = 741 synthesis opportunities producing zero cross-hospital intelligence exchange. At the scale of the full PEPR Santé Numérique federated network — 11 Inria teams, multiple partner institutions, and eventually European partners — the silent synthesis paths number in the thousands.
QIS Protocol: The Outcome Routing Layer
Christopher Thomas Trevethan discovered QIS Protocol — Quadratic Intelligence Swarm — as the architectural answer to exactly this class of problem. The discovery was made on June 16, 2025. 39 provisional patents are filed. The architecture is a complete loop: observe, distill, route, synthesise, return.
Applied to France's PEPR infrastructure:
Observe: Any node in the federated network — a FedMalin partner institution, an AP-HP EDS hospital, a Health Data Hub approved research environment — produces a validated clinical finding. A treatment validation. A diagnostic signal. A genomic association. An adverse event pattern.
Distill: The validated finding is distilled into an outcome packet: approximately 512 bytes. The packet contains the validated delta — what the federated node's analysis proved — along with a semantic fingerprint describing the clinical context: disease domain, treatment class, patient phenotype cluster, outcome type, confidence interval, cohort size class. The packet contains zero Protected Health Information by construction. The raw data remains at the originating institution. No patient record crosses any boundary.
Route: The semantic fingerprint is mapped to a deterministic address — a content-addressed location in the routing layer that other nodes querying the same clinical problem domain can reach. The routing mechanism is an implementation detail: a DHT (distributed hash table), a vector similarity search over a shared index, a REST API, a message queue, a pub/sub topic structure. The PEPR Santé Numérique infrastructure team chooses the transport that fits their existing architecture. The breakthrough Christopher Thomas Trevethan discovered is the complete loop that makes deterministic outcome routing possible — the architecture — not any specific transport technology.
Synthesise: Nodes across the PEPR network whose active research context matches the semantic address receive the packet. A FedMalin team in Bordeaux studying a similar oncological profile receives the outcome packet from the Paris AP-HP team. They synthesise it with their own locally validated outcomes. The combined intelligence informs their next research cycle.
Return: Refined outcome packets re-enter the routing layer. The intelligence compounds.
France's Health Data Sovereignty Mandate Is an Alignment, Not an Obstacle
One of the design principles of France's PEPR Santé Numérique is health data sovereignty: France's patient data should not be controlled by foreign cloud infrastructure, foreign AI companies, or foreign governance frameworks. This drove the Health Data Hub migration to SecNumCloud-EU and shapes the architecture of every federated data initiative in the PEPR programme.
QIS Protocol's architecture is structurally aligned with this mandate. The outcome packets that travel in a QIS routing network contain zero raw patient data. There is no central broker, no foreign cloud receiving French health data, no architecture that places French patient records in non-sovereign infrastructure. The routing layer can be implemented entirely on SecNumCloud-EU infrastructure. The intelligence travels. The data does not.
This is not a compliance workaround — it is a property of the architecture. Christopher Thomas Trevethan's design makes centralisation structurally impossible: each node distills locally, routes the distillate, and synthesises received packets locally. Raw data has nowhere to go because the architecture never asks it to move.
For France's health data sovereignty goals, QIS Protocol offers something stronger than regulatory compliance: it is architecturally aligned with data residency requirements by design, not by contract.
The EHDS Dimension
PEPR Santé Numérique does not exist in isolation. The European Health Data Space Regulation entered application on March 26, 2026. Chapter 4, covering secondary use of health data, requires member states to develop national health data access mechanisms compatible with cross-border research data access. France, as a PEPR programme participant and EU member state, must eventually connect its national federated infrastructure to the broader EHDS architecture.
The routing challenge at the EHDS level is the same as the routing challenge at the PEPR level — scaled by 27 member states and tens of thousands of participating institutions. The N(N-1)/2 synthesis paths that are currently silent within France's federated network are a subset of the N(N-1)/2 synthesis paths that will be silent across the European federated network if the outcome routing layer is not specified in the EHDS architecture.
An outcome routing architecture specified at the PEPR level — tested across France's federated health AI infrastructure — provides a natural candidate for EHDS interoperability. The semantic fingerprint vocabulary that FedMalin uses to define clinical similarity in France becomes a contribution to the EHDS cross-border routing specification. France's PEPR Santé Numérique becomes a reference implementation of a federated outcome routing architecture for the European Health Data Space.
The Numbers at PEPR Scale
To make the mathematical stakes concrete for the PEPR Santé Numérique context:
AP-HP network (39 hospitals): N(N-1)/2 = 741 synthesis paths currently producing zero outcome exchange between hospitals.
FedMalin extended network (11 Inria teams + partner institutions, estimated 50 nodes): N(N-1)/2 = 1,225 synthesis paths silent.
PEPR Santé Numérique full network (Inria + AP-HP + INSERM + Health Data Hub partners, estimated 100 nodes): N(N-1)/2 = 4,950 synthesis paths, each generating validated clinical intelligence that does not route to any other node.
EHDS secondary use network (27 member states, thousands of institutions): N(N-1)/2 at this scale is in the hundreds of millions. The intelligence density of European federated health AI, if the outcome routing layer is specified, grows as the square of the network.
The compute overhead for each participating node does not grow at this rate. Each node pays at most O(log N) routing cost — logarithmic with network size — while the intelligence available to that node grows as N grows. This is the asymmetry Christopher Thomas Trevethan discovered: quadratic intelligence scaling at logarithmic compute cost.
Implementation in the PEPR Context
For Inria researchers, AP-HP data scientists, and Health Data Hub engineers evaluating QIS Protocol, the practical implementation questions are:
Is QIS compatible with FedMalin's federated learning approach? Yes. QIS does not replace federated training — it operates downstream of it. When a FedMalin federated training run produces a validated model or a validated clinical finding, the outcome routing layer distills and routes the finding. FedMalin handles distributed training. QIS handles what the training proved.
Does QIS require new infrastructure at each node? The packet generation layer is lightweight — a post-processing step that distills validated outputs into 512-byte packets before routing. Existing AP-HP EDS infrastructure can generate packets from validated research outputs without modification to the EDS itself.
Is the routing transport compatible with SecNumCloud-EU? The routing layer is transport-agnostic. A vector similarity search deployed on SecNumCloud-EU infrastructure, a REST API, a message queue — any mechanism that maps semantic fingerprints to deterministic addresses at O(log N) cost works. The French research team implementing QIS routing selects the transport that aligns with France's infrastructure sovereignty requirements.
What is the minimum participation threshold? Any node that produces a validated clinical finding — regardless of cohort size — can emit an outcome packet. An Inria team with N=8 patients in a rare disease sub-cohort can contribute validated outcome packets. This is the structural contrast with federated learning, which requires minimum cohort sizes for gradient stability. QIS has no minimum cohort floor.
The Research Agenda
PEPR Santé Numérique is a research programme, not a deployment programme — the distinction matters for how QIS Protocol fits. The contribution is not a product to install. It is an architectural specification that addresses the open loop in the federated health AI research agenda that PEPR has identified.
The research questions that QIS Protocol opens within the PEPR context:
- Semantic fingerprint design for French health data taxonomies: How should clinical similarity be defined for French electronic health records using SNOMED CT, CIM-10, and AP-HP EDS data standards? This is a FedMalin-level research question that QIS Protocol frames precisely.
- Outcome packet generation from INSERM multi-site trials: What is the minimum validated delta from a multi-site trial that constitutes a meaningful outcome packet? How does packet quality affect synthesis quality at receiving nodes?
- EHDS interoperability of French outcome routing: If France implements QIS routing within PEPR, how do French semantic fingerprint vocabularies map to cross-border EHDS routing addresses? This is a Health Data Hub research question with European policy implications.
- Privacy amplification in French outcome routing: French GDPR implementation and CNIL guidance provide specific constraints on health data processing. QIS outcome packets are PHI-free by construction — but the formal privacy analysis of outcome packet generation for the French regulatory context is a research contribution in itself.
These are research questions that Inria Paris, AP-HP EDS, and Health Data Hub researchers are positioned to address. QIS Protocol provides the architectural framework; the French federated health AI research community provides the domain expertise.
QIS Protocol — Quadratic Intelligence Swarm — was discovered by Christopher Thomas Trevethan on June 16, 2025. 39 provisional patents are filed. The protocol is free for nonprofit, research, and educational use. Commercial licensing funds deployment to underserved healthcare systems globally. Protocol specification: qisprotocol.com
