The Kimi K3 licence: what does it actually stop you doing?
6 min read
On 22 July, writing about Kimi K3, we headed a section “A licence that does not yet exist” and closed it so: until the text is public, every production decision is provisional by definition. On 27 July 2026 Moonshot AI uploaded to Hugging Face the full weights of the model its own card calls “the world’s first open 3T-class model” — multimodal, a one-million-token context window — and with them the LICENSE file. The text is there: under five hundred words, five numbered paragraphs. This piece reads it.
Headlines summarised it as “open, but with a catch”. A condition does exist. It is far less true that it touches the people who read these pages, and that is worth saying with the document in hand rather than amplifying the alarm.
The grant, and the obligation that binds everyone
The frame is MIT’s. Permission to anyone obtaining a copy of the software — defined as “the model weights, parameters, configuration files, inference and training code, and associated documentation” — “to deal in the Software without restriction”: use, copy, modify, distribute, sublicense, sell, fine-tune, create derivative works. Then come the conditions.
Section 1 asks for two things: the copyright and permission notices “in all copies or substantial portions of the Software”, and use that complies with applicable laws. Redistribute weights or derivatives and that text travels with them. A documentary obligation, not a limit on use.
Who Section 2 is actually addressing
Section 2 defines “Model as a Service” narrowly: giving a third party access to inference or fine-tuning “in a manner that allows such third party to exercise meaningful control over the inputs, parameters, or training data”. And it excludes two cases in writing: “(a) end-user products with model capabilities solely embedded within specific features or harnesses”, and “(b) mere relaying of requests to models hosted by others”.
The rest of the work is done by Section 4, which almost nobody quotes. The requirements of Sections 2 and 3 “do not apply to: (a) internal use of the Software, defined as any use that does not make the Software, its outputs, or its underlying capabilities available to third parties”.
For a company or a public body running the model inside its own perimeter, on its own documents, for its own staff: no agreement to sign, no attribution to display, no threshold to monitor. Section 2 is not written for the organisation that installs. It is written for whoever resells inference.
Where it really bites
Three points, none of them reassuring.
The threshold measures the group, not the AI business. If the licensee “or any of its affiliates” operates a Model as a Service business and the aggregate revenue of licensee and affiliates exceeds “20 million US dollars … in total over any consecutive 12 months”, a separate agreement with Moonshot is required before using the software for any commercial purpose. Read literally: the threshold weighs group revenue, not revenue from inference sold; and the prior agreement does not cover that business alone, it covers every commercial use. An industrial group turning over fifty million, with a subsidiary exposing an API to third-party customers, falls under the obligation even for the model running on the shop floor. Not a small-business problem: a group problem.
“Internal use” excludes outputs too. Section 4 defines as internal any use “that does not make the Software, its outputs, or its underlying capabilities available to third parties”. Does a professional firm, or a service provider delivering a client a document produced with the model, make outputs available to third parties? The text does not say, and we will not pretend to know: a real ambiguity, settled before signature by writing to license@moonshot.ai and keeping the reply with its date.
The measure is the control you grant, not the label you use. If your product lets the customer tune parameters or upload training data, you are inside the definition even if your price list says “business software”: “meaningful control over the inputs, parameters, or training data” is a functional test.
“Twenty million” twice, two different things
Section 3 requires “Kimi K3” to be “prominently displayed” on the interface of commercial products or services with more than 100 million monthly active users, or more than 20 million US dollars in monthly revenue. Same figure as Section 2, opposite horizon: there, twenty million over twelve months; here, twenty million a month. Read quickly, the two are out by a factor of twelve.
An honest note on Section 4(b): it also exempts use “accessed through Moonshot AI’s official products or certified inference partners”. The text does not say who certifies, against what criteria, or where the list is published: an exemption that depends on a list the licence does not publish.
The line procurement reads first
Section 5. Software and outputs provided “ON AN ‘AS IS’ BASIS, WITHOUT WARRANTY OF ANY KIND”, with express exclusion of “MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT”, and no liability on Moonshot or its affiliates. Not a Chinese peculiarity: it is the risk model of open weights, identical in MIT and Apache 2.0. The practical point is elsewhere: with a commercial supplier, indemnity against third-party IP claims is negotiated; here no counterparty is bound to anything, and a claim over the weights sits entirely with whoever installed them. It belongs in the economic comparison next to the API saving.
The gate no licence opens
Legal permission and operational feasibility are two different doors. The repository’s public API measures 1,561,018,243,668 bytes — about 1.56 terabytes — for 2,779,931,837,184 parameters, and nearly a hundred thousand downloads in two days. It says something else too: the compression is not your option, it is already in the file. The configuration declares the format mxfp4-pack-quantized, 4-bit weights in groups of 32 with MXFP8 activations, obtained in training and not applied afterwards; the “8-bit” tag on the repository describes the tensor container, not the precision of the weights. Consequence: no full-precision checkpoint to fall back on, and any further compression starts from there. We have already done the hardware arithmetic: the starting point is now measured, not estimated. On the politics around open weights we add nothing here: it is a supply risk, and belongs in the tender documents as one.
How we handle it
A permissive licence makes the model installable. It does not make the environment compliant, and does not decide where your data runs or who may see it: those are architectural choices. That is why we deliver in two modes and no others: on-premise in the client’s own environment, or on our dedicated cloud — reserved for the single client, access over a dedicated VPN, data centre resident in Italy, premises we staff ourselves. In both, the perimeter the model runs in is documentable: it is how we set up the installation before choosing which model runs inside it.
Do you have to decide whether Kimi K3 can go into production, and your legal team has asked what Section 2 actually says? Half an hour with one of our specialists: we read the text together and put in writing what to ask Moonshot before you install.