Quick answer: Applying a documented federated learning framework to a straightforward setting — enrolling sites, running an established aggregation algorithm, and confirming it trains — is generally unlikely to be a core R&D activity on those facts, subject to the activity's own facts and the statutory tests. A core R&D activity may sit narrower: where it is unknown whether any federated or privacy-preserving regime can reach a required accuracy under non-IID data, constrained bandwidth or a formal privacy budget, determinable only by a systematic progression of work. You self-assess.
18 August 2026 — this article describes the current rules. The 2026–27 Federal Budget announced R&DTI reforms that will apply to income years starting on or after 1 July 2028. Until then, the program continues to be administered under the current legislation.
The reason a team reaches for federated learning is usually contractual or legislative rather than scientific: the data sits inside six hospitals, or six credit unions, or on ten thousand handsets, and it cannot be pooled. That constraint is real and it makes the engineering harder. It does not, by itself, create an outcome that cannot be known in advance, and the R&D Tax Incentive's core test is about the unknown rather than the difficulty or the obligation.
This article is about the training regime when data cannot be centralised. It does not cover running a model on constrained hardware after training, the data foundations underneath it — labelling, synthetic data and drift — or the engineering of transport and infrastructure data pipelines. Each is treated separately in our Insights.
What the Official Guidance Already Treats as Ordinary Work
AusIndustry's AI sub-guide lists activities that are generally not core R&D activities. Several of them describe most of what a first federated deployment consists of, verbatim:
"implementing logging, alerts, dashboards, or routine performance checks using established methods and tools to confirm expected model behaviour · cleaning, formatting, and aligning data to meet a model's documented input requirements using standard data preparation techniques, where the transformations required are known in advance · running regression, acceptance, or functionality tests using established testing methods to confirm a system works as intended, where expected outcomes are already known · adjusting or fine-tuning parameters (e.g. learning rate) using established methods when it is known that the issue can be solved by parameter changes and the effect of changing the parameter is well understood · integrating known model outputs (such as scores, labels and recommendations) into applications or dashboards, using pre-defined logic, rules and interfaces, where the behaviour of the model and the integration approach are established"
Read against a federated build, that list absorbs the client agent, the enrolment and key exchange, the round orchestration, and the parameter sweep that gets the documented example converging on your schema. The same guide is blunt about novelty of tooling: "Using an AI model or technique that is new to you does not, by itself, mean the activity is eligible for the program", and "using AI in software development does not make an activity eligible" (business.gov.au). A first encounter with a federated framework, a secure-aggregation library or a differential-privacy accountant is a first encounter.
Against that, the guide states where AI work may reach the core test: "AI-related activities may meet the requirements of a core R&D activity where a technical hurdle exists and an expert in the field considers that only experimentation will determine if a proposed solution, or the way to develop a solution, can resolve the technical hurdle."
The Core Test, Stated in Full
Core R&D activities are experimental activities whose outcome cannot be known or determined in advance on the basis of current knowledge, information or experience, but can only be determined by applying a systematic progression of work that is based on principles of established science and proceeds from hypothesis to experiment, observation and evaluation, and leads to logical conclusions; and that are conducted for the purpose of generating new knowledge, including new knowledge in the form of new or improved materials, products, devices, processes or services (s 355-25(1), ITAA 1997; business.gov.au). ("Competent professional" is AusIndustry guidance wording used to describe how the first limb is assessed; it is not the statutory language.)
Federated work has an unusual relationship with the established-science limb. The tools sit on genuinely established ground — the composition theorems behind a differential-privacy accountant, the convergence theory for averaged stochastic optimisation, the statistics of covariate and label shift across clients — which is what a systematic progression here can be based on. But that same maturity is why a straightforward deployment falls short on the outcome limb instead: the theory already indicates what will happen, so the outcome is determinable in advance from current knowledge.
A Privacy Obligation Is Not, by Itself, an Unknown
A common framing error here is to treat the obligation as the uncertainty: the Privacy Act applies, or the contract forbids export, or an ethics approval limits the extract, therefore the work of satisfying that constraint is R&D. The statute does not connect those.
Paragraph (f) — Statutory requirements and standards
Paragraph (f) of s 355-25(2) excludes activities associated with complying with statutory requirements or standards, including one or more of the following: (i) maintaining national standards; (ii) calibrating secondary standards; (iii) routine testing and analysis of materials, components, products, processes, soils, atmospheres and other things. "Associated with" is broad, and reasoning towards a carve-out from it is not the sound course. Whether development work aimed at meeting a standard falls inside paragraph (f) is a question of fact, assessed activity by activity, and the company self-assesses. Compliance mapping, control implementation, audit evidence and privacy-impact documentation may fall within that exclusion where the activities are undertaken to meet or demonstrate compliance with a statutory requirement or standard.
Paragraph (e) — Commercial, legal and administrative aspects
Excludes commercial, legal and administrative aspects of patenting, licensing or other activities — which may apply to IP licensing, access arrangements, IP-sharing agreements and related commercial, legal or administrative activities.
Paragraph (g) — Reproduction of a commercial product or process
Excludes any activity related to the reproduction of a commercial product or process (i) by a physical examination of an existing system, or (ii) from plans, blueprints, detailed specifications or publicly available information. Both elements have to be present. Reimplementing a published federated algorithm from its paper and reference code plainly engages the second element, but a published method or an open-source repository is not by itself a commercial product or process, so paragraph (g) does not automatically apply. Where such work falls short, it is usually for the plainer reason: the outcome was determinable in advance. See what does not qualify.
Where the Federated Question Can Become the Experiment
Three conditions recur in which the answer is not available from current knowledge, information or experience:
Non-IID data across participants: Convergence results for averaged local updates assume something about how similar the client distributions are. Where each site has a materially different case mix, label definition or instrument, whether any aggregation regime reaches a stated operating point on the worst site — not the mean — can be genuinely open.
A formal privacy budget: Once a per-participant budget is fixed in advance (an ε and δ under a stated accountant and mechanism), the noise that budget forces interacts with client heterogeneity, cohort size and round count. Whether a required accuracy is reachable at all inside that budget is the kind of question that can come back "no", which is what makes it a question.
Constrained or intermittent participation: Uplink caps, devices that drop mid-round, and sites available only overnight change which update-compression and client-sampling regimes can hold accuracy. Where the literature answers that for your setting, it is answered; where the setting is materially different, it may not be.
The distinguishing feature in each is that the technical uncertainty is expressed through a testable hypothesis and investigated through the required systematic progression of work, with a negative result remaining a possible outcome.
A Worked Hypothetical: Can a Fraud Model Reach the Target Inside ε = 2.0?
Hypothetical and illustrative. The figures are invented to show the shape of an experiment; nothing here indicates that any activity is eligible.
Six regional mutual lenders engage a South Australian fintech to build a shared card-fraud detector. Member transaction data cannot leave each institution. Each lender's mix differs sharply: two are agricultural-region lenders with seasonal volumes, one is metropolitan and roughly four times the size of the smallest.
Baseline: Each lender's own locally trained model. Macro-recall across the six, at a fixed alert budget of one alert per 1,000 transactions, is 0.58; the smallest lender reaches 0.36.
Requirement, recorded 3 March: A regime is accepted only if it reaches macro-recall ≥ 0.80 at the same alert budget, with no single lender below 0.72, while spending no more than ε = 2.0 at δ = 1e-5 per participating institution under a stated accountant, within ≤ 25 MB uplink per site per round and ≤ 60 rounds. Miss any one and the consortium reverts to six local models plus a shared rules list.
The search, recorded the same week: Published federated and differentially private results for transaction fraud, the framework's own benchmarks, and the two commercial platforms evaluated all reported at cohort sizes in the hundreds or thousands of clients, where per-client noise amortises. None reported a six-participant cohort with a four-to-one size imbalance at a single-digit ε. Hypothesis: heterogeneity can be handled in the client objective rather than in the aggregation rule, leaving the weights data-independent so they consume no privacy budget. Established-science basis: privacy-loss composition under the stated mechanism, and the convergence theory for proximally regularised local optimisation.
Held constant & varied: Held constant across trials: features, alert budget, per-site sealed evaluation windows, model architecture, round schedule, the privacy accountant and its parameters. Varied: only the aggregation and client-objective regime.
Trials:
Trial 1 — Averaged local updates with per-example clipping and Gaussian noise, uniform weighting: Macro-recall 0.66; worst lender 0.41. Short on both conditions.
Trial 2 — Server-side quality-weighted aggregation (Failed): Clients reported local validation loss; server weighted updates by it. Statistic had to be noised to stay inside budget; at ε = 2.0 weights oscillated, then drifted against the two smallest lenders. Their recall collapsed to 0.29 and macro-recall fell to 0.61. What it ruled out: this quality-weighted aggregation approach using the tested privacy-noised scalar signal was not viable at this cohort size and privacy budget.
Trial 3 — Proximal regularisation of local objective, fixed sample-count weighting, 8-bit update quantisation: Macro-recall 0.74; worst lender 0.63; 21 MB per site per round. Transfer improved, target still missed.
Trial 4 — Proximal regularisation + adaptive update clipping (clip norm calibrated on public synthetic transaction corpus) + pre-agreed feature normalisation: On sealed evaluation windows: macro-recall 0.83, worst lender 0.76, ε spent 1.9, 23 MB per round, 54 rounds. Both accuracy conditions met inside the budget.
The result reached: For this six-participant cohort and the approaches tested, the target was reached using data-independent aggregation with client-side heterogeneity control; the tested quality-weighted approach was not viable at that privacy budget.
The activity boundary: For this example, the candidate experimental activity is documented from the formulation of the hypothesis and experimental approach through to the trials, evaluation and recorded conclusion. The orchestration service, enrolment and key management, the audit log, the data-sharing agreements, the privacy impact assessment and the monitoring dashboards are separate work — some of it engaging paragraphs (e) and (f) above. Rolling the accepted model into each lender's alert queue, and retraining it on a schedule, sits outside as well. Describing work this way is not classifying it: whether any activity meets s 355-25 or s 355-30 is determined on its own facts, and the company self-assesses.
How the Infrastructure Is Usually Approached
Supporting R&D activities are activities directly related to core R&D activities. But where an activity (a) is an activity referred to in s 355-25(2), or (b) produces goods or services, or (c) is directly related to producing goods or services, it is a supporting R&D activity only if it is undertaken for the dominant purpose of supporting core R&D activities (s 355-30(2); business.gov.au).
Each limb is tested against the particular activity, never against the platform or the business as a whole. Where a federated orchestration service produces, or is directly related to producing, goods or services, the additional dominant-purpose test applies if it is being assessed as supporting R&D. Compliance activities likewise engage that additional test where they are activities referred to in s 355-25(2). A harness built only to run and score the trials sits differently from the same code once it is the live pipeline.
Where an RSP Fits
business.gov.au describes Research Service Providers as scientific or technical service providers, registered in specific fields, that a company can engage to conduct R&D activities on its behalf (business.gov.au). Qualifying expenditure incurred to a non-associate RSP may still form part of the offset where total notional deductions are below the usual $20,000 threshold, provided the services are within a research field for which the RSP is registered. And using an RSP does not guarantee eligibility — you still self-assess. See claiming R&D under $20,000 and what an RSP is; offset rates and the conditions attaching to them are covered separately in refundable vs non-refundable offset.
Talk to Ignition Research before you commit a consortium to a federated build — as a Registered Research Service Provider at Lot Fourteen in Adelaide we work upstream of any claim, fixing the privacy budget, the accuracy conditions and the measurement before the first round runs, so the technical question is answered on evidence. We are not a registered tax agent; your company self-assesses and remains responsible for its own claim, with advice and lodgement handled by your tax adviser. Get in touch.
Frequently Asked Questions
Q: Is federated learning an eligible R&D activity in Australia?
A: Not by virtue of being federated. Applying a documented federated framework to a straightforward setting is generally unlikely to be a core R&D activity on those facts, subject to the activity's own facts and the statutory tests. A core R&D activity may exist where it could not be determined in advance, on current knowledge, information or experience, whether any federated regime reaches a required accuracy under non-IID client data, constrained bandwidth or a fixed privacy budget, and could only be determined by a systematic progression of work based on principles of established science, conducted to generate new knowledge. You self-assess.
Q: Does having a privacy obligation make the work R&D?
A: No. The existence of a legislative or contractual privacy obligation is a constraint, not an unknown outcome, and s 355-25(2)(f) excludes activities associated with complying with statutory requirements or standards. "Associated with" is broad, and whether particular development work aimed at meeting a standard falls inside paragraph (f) is a question of fact assessed activity by activity. The eligibility question turns on whether a specific technical outcome was determinable in advance, not on why the constraint exists.
Q: Is implementing differential privacy claimable under the R&D Tax Incentive?
A: Configuring an established mechanism and accountant to a documented recipe, and confirming it runs, is generally unlikely to be a core R&D activity on those facts, subject to the activity's own facts and the statutory tests. The position can differ where the unknown is whether a stated accuracy target is reachable at all inside a privacy budget fixed in advance for a particular cohort — provided the technical uncertainty is investigated through a testable hypothesis and the required systematic progression of work, with a negative result remaining a possible outcome.
Q: Is building the federated infrastructure core or supporting R&D?
A: Orchestration, enrolment, key management and monitoring are normally considered against the supporting-activity provision rather than the core test. They must be directly related to a core R&D activity; and where an activity is of a kind referred to in s 355-25(2), produces goods or services, or is directly related to producing goods or services, it is a supporting R&D activity only where undertaken for the dominant purpose of supporting core R&D activities. Where the platform produces, or is directly related to producing, goods or services, the dominant-purpose test also applies if the activity is being assessed as supporting R&D.
Sources & Further Reading
business.gov.au — AI-related activities and the R&D Tax Incentive
ATO — Tax Reform: better targeting the R&D Tax Incentive — the announced measures and the statement that the measure is not yet law
industry.gov.au — Research and Development Tax Incentive — the proposed changes would apply to income years starting on or after 1 July 2028 if enacted
legislation.gov.au — Income Tax Assessment Act 1997 — Div 355, incl. ss 355-25 and 355-30
Related: R&D for software and AI · R&D for fintech · what does not qualify · what an RSP is · claiming R&D under $20,000 · refundable vs non-refundable offset · Insights
This article is general information from a Registered Research Service Provider about the R&D Tax Incentive. It is not tax, legal or financial advice; eligibility depends on your circumstances and you should self-assess and seek your own advice.
Thinking about a project like this?
If you're weighing up an AI, software or technical improvement project and can't tell yet whether it's implementation or research, start with a quick read on where it sits.