IT EN
Start a trial

Operational notes Observatory

Google’s TimesFM 3.0: the card changes licence, the weights don’t

8 min read

Close-up of the metal gnomon of a stone sundial, its shadow falling near the applied metal numerals "12" and "15", black and white photograph
The same sundial, the same shadow: it keeps moving, and whoever does not check it often does not notice.

On 24 August 2026, at 22:41:42 UTC, Google uploaded the weights of TimesFM 3.0 to Hugging Face, its open-weight model for time-series forecasting: 330.7 million parameters, a single file of roughly 1.23 GB. In the README that came with that upload, the field declaring the licence said one thing: license: apache-2.0. Sixty-nine hours and thirty-nine minutes later, without the repository name changing by a single letter and without a single byte of the weights being touched, that field said something else: non-commercial licence, production use forbidden. Anyone who downloaded the model by name alone — google/timesfm-3.0-pytorch — without pinning an exact revision, can hold a file on disk that is identical to today’s, paired with a permission that no longer exists. Nothing about the file itself would ever tell them that.

The facts, in order

  • 24 August 2026, 22:05:51 UTC — initialisation commit for the google/timesfm-3.0-pytorch repository on Hugging Face.
  • 24 August 2026, 22:41:42 UTC — commit “Upload TimesFM 3.0 PyTorch model weights and config”: uploads model.safetensors (1,322,898,824 bytes, 330,710,976 parameters in F32) and config.json (20 transformer layers, dimension 1280, 16 heads, context patch 32, horizon patch 64, up to 32 simultaneous variates). The README declares license: apache-2.0. No LICENSE file exists yet in the repository tree.
  • 27 August 2026, 20:21–22:13 UTC — three commits in under two hours: the first LICENSE file ever added (7,270 bytes, never present before), the license: apache-2.0 field removed from the README, then the front matter rewritten as license: other, license_name: timesfm-non-commercial-license-v1.0.
  • 28 August 2026, 23:34:07 UTC — on GitHub, in google-research/timesfm, a commit adds a note that explicitly sets version 3.0 apart from the earlier ones (see below).
  • 28 August 2026, 23:42:49 UTC — Google publishes the official GitHub release tagged v3.0.0, named “TimesFM-3.0”: four days after the weights were first uploaded, more than twenty-five hours after the licence swap on Hugging Face was already complete.
  • 28 August–2 September 2026 — six more commits still touch the README on Hugging Face, including one merged as pull request “#1,” co-authored by an outside contributor (handle ayujain25), that also fixes the citation year of the original paper, from 2024 to 2023 — the same contributor opened matching pull requests, numbered #470 and #471, on the GitHub repository that same day. The latest commit on the Hugging Face main branch, at the time of this check, is from 2 September at 15:44:59 UTC, titled “Test removing timesfm tag to check library_name”; that same day, on GitHub, two more commits still fix how the timesfm3 code module aligns past-future covariate windows, after the v3.0.0 tag had already shipped.
  • At the time of verification, 4 September 2026, the Hugging Face API shows 46,862 downloads and 357 likes on the repository.

What the repository name does not tell you

The weight file has never moved: the same hash — Git and LFS alike — appears in the repository tree from 24 August to today, byte for byte identical. The change sits entirely in the document that accompanies it, and it is a change of rights, not of content. Apache 2.0, as it stood in the 24 August README, permits commercial use, distribution and derivatives, with no condition beyond attribution. The licence that replaced it, timesfm-non-commercial-license-v1.0, rules out any commercial use and any production deployment, defining “Non-Commercial Purpose” as “use for testing, evaluation, or research not tied to commercial gain, production deployment, or revenue generation.” A separate line among the restrictions, with no purpose qualifier attached, also bans “Distribute the TimesFM Model or a Derivative” — not just commercial use: distribution itself, full stop. The same document goes further than most non-commercial research licences, putting the compliance burden squarely on the downloader: it requires that “any use of the TimesFM Model, Derivatives, and Outputs complies with applicable data protection, privacy, export control, and AI regulations (including, where applicable, GDPR and the EU Artificial Intelligence Act).”

The GitHub commit from 28 August explains why the jump is specific to this version: “model weights up to version 2.5 remain Apache-2.0. However, for the time being, TimesFM 3.0 pretrained weights are distributed under the separate timesfm-non-commercial-license-v1.0 license.” We checked this independently: the card for google/timesfm-2.5-200m-pytorch, the prior model, still declares license: apache-2.0 today. Anyone coming from that version had every reason, for three days, to assume nothing had changed: the TimesFM 3.0 card itself confirmed it.

The official announcement does not help whoever arrives afterwards. The GitHub v3.0.0 release, published when the swap had already been complete for over a day, reads in full: “New model weights and associated code: TimesFM-3.0.” No mention of the licence, and none of the change made two days earlier. Anyone who trusts only the announcement learns nothing from that text about the permission being different from the previous version — and the branch keeps moving even after the tag: a citation-year fix, a library tag removed, a commit whose title opens with the word “Test,” all landing after the point at which anyone would have called the model released.

What we could not verify

We did not find, or reach, a dedicated announcement on the Google Research or Google Cloud blog: we relied on the official GitHub repository, a direct company channel, not a third-party source. We do not know how many of today’s 46,862 downloads date from the 69-hour window in which the card declared Apache 2.0: the Hugging Face API publishes no count broken down by time or by revision. We did not run the model, nor reproduce the benchmark rankings (GIFT-Eval, fev-bench, TIME) that the press attributes to Google: those are numbers declared by the vendor and reported by third parties, not measured by us. And we do not know whether, among those who cloned the repository between 24 and 27 August, a copy of the Apache 2.0 README still survives somewhere: the file is not deleted — it stays in the commit history — but no one notices it unless they go looking on purpose. Nor do the commits themselves say why the swap happened: nothing in the commit messages or in the GitHub note calls it a correction of a mistaken tag rather than a deliberate change of plan, and we found no statement from Google either way.

What to do, in practice

  • When you download a model with from_pretrained or git clone, pin an exact revision, not just the repository name: it is the only way to know for certain which licence you actually accepted.
  • Before production, save a local copy of the LICENSE file alongside the weights, dated: if it changes later, you will have proof of which version you agreed to.
  • Do not assume licence continuity between one version and the next in the same family: check every major release, not just the first time.
  • Read the licence text, not just the label: a clause like a distribution ban, kept separate from the one on commercial use, changes what you can do even inside a non-profit internal project.
  • Treat an official announcement as a starting point, not the full list of conditions: the TimesFM 3.0 release text did not mention the licence that had already changed.

The two axes, applied

Compliance. A public body or a company evaluating an open-weight model for a real use case — demand forecasting, predictive maintenance, planning — must be able to show, in an audit or a compliance check, exactly which licence covered the file it runs, on the date it was downloaded. A repository name is not proof: what is needed is the revision, the commit, a copy of the legal text kept alongside the weights.

Decision-making. The same principle holds for the architecture behind the systems we build for large enterprises, government and defence: every component — data, model, agent, human operator in command — is tracked to the exact version running, not to the vendor’s generic label. In two modes, on-premises on autonomous machines or on a dedicated cloud with a VPN and a data centre in Italy, always with shared management: no one discovers in an audit that the model they had been running was no longer, for weeks, the one they had checked.

Do you have an open-weight model in production that you downloaded months ago, and no longer know whether its licence is still the one you read? Talk it through in a thirty-minute session: we check the repository history with you before a client or an inspector does it for you.

Sources