---
title: "Google’s TimesFM 3.0: the card changes licence, the weights don’t"
description: "On 24 August 2026 Google uploaded TimesFM 3.0’s weights to Hugging Face under an Apache 2.0 licence declared on the card. Sixty-nine hours later, on the same bytes, the licence became non-commercial — and the official GitHub announcement landed a day later, after the swap was already done."
url: https://csidia.com/en/notes/timesfm-3-licenza-cambiata-tre-giorni-dopo/
lang: en
date: 2026-09-04
label: "Observatory"
publisher: CSIDIA S.r.l. (https://csidia.com/)
italiano: https://csidia.com/note-operative/timesfm-3-licenza-cambiata-tre-giorni-dopo/
---

# Google’s TimesFM 3.0: the card changes licence, the weights don’t

On 24 August 2026, at 22:41:42 UTC, Google uploaded the weights of **TimesFM 3.0** to Hugging Face, its open-weight model for time-series forecasting: 330.7 million parameters, a single file of roughly 1.23 GB. In the README that came with that upload, the field declaring the licence said one thing: `license: apache-2.0`. Sixty-nine hours and thirty-nine minutes later, without the repository name changing by a single letter and without a single byte of the weights being touched, that field said something else: non-commercial licence, production use forbidden. Anyone who downloaded the model by name alone — `google/timesfm-3.0-pytorch` — without pinning an exact revision, can hold a file on disk that is identical to today’s, paired with a permission that no longer exists. Nothing about the file itself would ever tell them that.

## The facts, in order

- **24 August 2026, 22:05:51 UTC** — initialisation commit for the `google/timesfm-3.0-pytorch` repository on Hugging Face.
- **24 August 2026, 22:41:42 UTC** — commit “Upload TimesFM 3.0 PyTorch model weights and config”: uploads `model.safetensors` (1,322,898,824 bytes, 330,710,976 parameters in F32) and `config.json` (20 transformer layers, dimension 1280, 16 heads, context patch 32, horizon patch 64, up to 32 simultaneous variates). The README declares `license: apache-2.0`. No `LICENSE` file exists yet in the repository tree.
- **27 August 2026, 20:21–22:13 UTC** — three commits in under two hours: the first `LICENSE` file ever added (7,270 bytes, never present before), the `license: apache-2.0` field removed from the README, then the front matter rewritten as `license: other`, `license_name: timesfm-non-commercial-license-v1.0`.
- **28 August 2026, 23:34:07 UTC** — on GitHub, in `google-research/timesfm`, a commit adds a note that explicitly sets version 3.0 apart from the earlier ones (see below).
- **28 August 2026, 23:42:49 UTC** — Google publishes the official GitHub release tagged `v3.0.0`, named “TimesFM-3.0”: four days after the weights were first uploaded, more than twenty-five hours after the licence swap on Hugging Face was already complete.
- **28 August–2 September 2026** — six more commits still touch the README on Hugging Face, including one merged as pull request “#1,” co-authored by an outside contributor (handle `ayujain25`), that also fixes the citation year of the original paper, from 2024 to 2023 — the same contributor opened matching pull requests, numbered #470 and #471, on the GitHub repository that same day. The latest commit on the Hugging Face `main` branch, at the time of this check, is from 2 September at 15:44:59 UTC, titled “Test removing timesfm tag to check library_name”; that same day, on GitHub, two more commits still fix how the `timesfm3` code module aligns past-future covariate windows, after the `v3.0.0` tag had already shipped.
- **At the time of verification**, 4 September 2026, the Hugging Face API shows 46,862 downloads and 357 likes on the repository.

## What the repository name does not tell you

The weight file has never moved: the same hash — Git and LFS alike — appears in the repository tree from 24 August to today, byte for byte identical. The change sits entirely in the document that accompanies it, and it is a change of rights, not of content. Apache 2.0, as it stood in the 24 August README, permits commercial use, distribution and derivatives, with no condition beyond attribution. The licence that replaced it, `timesfm-non-commercial-license-v1.0`, rules out any commercial use and any production deployment, defining “Non-Commercial Purpose” as “use for testing, evaluation, or research not tied to commercial gain, production deployment, or revenue generation.” A separate line among the restrictions, with no purpose qualifier attached, also bans “Distribute the TimesFM Model or a Derivative” — not just commercial use: distribution itself, full stop. The same document goes further than most non-commercial research licences, putting the compliance burden squarely on the downloader: it requires that “any use of the TimesFM Model, Derivatives, and Outputs complies with applicable data protection, privacy, export control, and AI regulations (including, where applicable, GDPR and the EU Artificial Intelligence Act).”

The GitHub commit from 28 August explains why the jump is specific to this version: “model weights up to version 2.5 remain Apache-2.0. However, for the time being, TimesFM 3.0 pretrained weights are distributed under the separate timesfm-non-commercial-license-v1.0 license.” We checked this independently: the card for `google/timesfm-2.5-200m-pytorch`, the prior model, still declares `license: apache-2.0` today. Anyone coming from that version had every reason, for three days, to assume nothing had changed: the TimesFM 3.0 card itself confirmed it.

The official announcement does not help whoever arrives afterwards. The GitHub `v3.0.0` release, published when the swap had already been complete for over a day, reads in full: “New model weights and associated code: TimesFM-3.0.” No mention of the licence, and none of the change made two days earlier. Anyone who trusts only the announcement learns nothing from that text about the permission being different from the previous version — and the branch keeps moving even after the tag: a citation-year fix, a library tag removed, a commit whose title opens with the word “Test,” all landing after the point at which anyone would have called the model released.

## What we could not verify

We did not find, or reach, a dedicated announcement on the Google Research or Google Cloud blog: we relied on the official GitHub repository, a direct company channel, not a third-party source. We do not know how many of today’s 46,862 downloads date from the 69-hour window in which the card declared Apache 2.0: the Hugging Face API publishes no count broken down by time or by revision. We did not run the model, nor reproduce the benchmark rankings (GIFT-Eval, fev-bench, TIME) that the press attributes to Google: those are numbers declared by the vendor and reported by third parties, not measured by us. And we do not know whether, among those who cloned the repository between 24 and 27 August, a copy of the Apache 2.0 README still survives somewhere: the file is not deleted — it stays in the commit history — but no one notices it unless they go looking on purpose. Nor do the commits themselves say why the swap happened: nothing in the commit messages or in the GitHub note calls it a correction of a mistaken tag rather than a deliberate change of plan, and we found no statement from Google either way.

## What to do, in practice

- When you download a model with `from_pretrained` or `git clone`, pin an exact revision, not just the repository name: it is the only way to know for certain which licence you actually accepted.
- Before production, save a local copy of the `LICENSE` file alongside the weights, dated: if it changes later, you will have proof of which version you agreed to.
- Do not assume licence continuity between one version and the next in the same family: check every major release, not just the first time.
- Read the licence text, not just the label: a clause like a distribution ban, kept separate from the one on commercial use, changes what you can do even inside a non-profit internal project.
- Treat an official announcement as a starting point, not the full list of conditions: the TimesFM 3.0 release text did not mention the licence that had already changed.

## Sources

- [Hugging Face — google/timesfm-3.0-pytorch, model card](https://huggingface.co/google/timesfm-3.0-pytorch)
- [Hugging Face API — model metadata (parameters, downloads, likes)](https://huggingface.co/api/models/google/timesfm-3.0-pytorch)
- [Hugging Face API — commit history on the main branch](https://huggingface.co/api/models/google/timesfm-3.0-pytorch/commits/main)
- [Hugging Face — google/timesfm-3.0-pytorch, README at the weight-upload commit (license: apache-2.0)](https://huggingface.co/google/timesfm-3.0-pytorch/blob/6455822fd4703713f3bf9cb2845f7ba51dc65250/README.md)
- [Hugging Face — google/timesfm-3.0-pytorch, LICENSE (full text of the timesfm-non-commercial-license-v1.0)](https://huggingface.co/google/timesfm-3.0-pytorch/blob/main/LICENSE)
- [Hugging Face — google/timesfm-2.5-200m-pytorch, previous model’s card (license: apache-2.0)](https://huggingface.co/google/timesfm-2.5-200m-pytorch)
- [GitHub — google-research/timesfm, release v3.0.0 “TimesFM-3.0”](https://github.com/google-research/timesfm/releases/tag/v3.0.0)
- [GitHub — google-research/timesfm, README.md at commit f32e2ac0 (note on the pretrained-weight licence)](https://github.com/google-research/timesfm/blob/f32e2ac0/README.md)
- [GitHub — google-research/timesfm, commit history](https://github.com/google-research/timesfm/commits/master)
- [MarkTechPost — “Google AI Releases TimesFM-3: A 330M Parameter Zero-Shot Foundation Model For Multivariate Time Series Forecasting,” 31 August 2026](https://www.marktechpost.com/2026/08/31/google-ai-releases-timesfm-3-a-330m-parameter-zero-shot-foundation-model-for-multivariate-time-series-forecasting/)

Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/timesfm-3-licenza-cambiata-tre-giorni-dopo/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com