On July 27, Moonshot AI uploaded the complete weights of Kimi K3 to HuggingFace. Released alongside the weights was a license of fewer than three thousand characters, named simply the Kimi K3 License. It permits anyone to download, deploy privately, fine-tune, and use it commercially for free, and even to resell it.
For companies building AI products, this is genuinely good news: a frontier-level model can be installed in their own server rooms, customer data need not leave the premises, and the path has suddenly opened for the financial, medical, and legal scenarios that have been constrained over the past two years by data security concerns.
But the next step is where things most easily go astray. "Free commercial use" concerns the relationship between you and Moonshot AI; "whether you may provide services to the public" concerns the relationship between you and the regulators. Under Chinese law, these two matters are entirely independent of each other. Before installing K3 into your own product, you must in practice pass through three separate and independent gates: the license answers only "whether you may use it," filing answers "whether you may provide it to the public," and liability rules answer "who pays if something goes wrong." The first gate is the widest, and is most easily mistaken for the whole. The following addresses them one by one in that order.
The three gates
What exactly is being opened this time
Moonshot AI's own wording is layered. Its official announcement states that it is releasing the model weights and technical report of Kimi K3, and open-sourcing three key infrastructure components supporting training: MoonEP, FlashKDA, and AgentEnv. For the model, it says the weights are released; only for these three infrastructure components does it use the words "open source."
This is not wordplay. The two batches of materials released on the same day do indeed receive different legal treatment: the three repositories use the unconditional standard MIT license, under which anyone may use them freely provided copyright and license notices are retained; the model itself uses a conditional bespoke license, which the official description characterizes as open-weight rather than open source. What you receive is the parameters, inference and training code, and technical report; the training data and the complete training process remain the private property of Moonshot AI and do not fully satisfy the Open Source Initiative (OSI) Open Source AI Definition.
In most scenarios this distinction is immaterial, but where a purchaser writes "must be OSI-recognized open source" into the tender conditions, the conclusion is different. A more practical point: when an enterprise establishes a license register, it must register each repository on a separate line and must not record this release as a single item.
Only after registering by repository does the question at the first gate truly begin: what exactly does the bespoke license for the model itself bind you to?
The license answers only "whether you may use it"
First, let me correct a widely circulated claim. Before K3 was released, almost all Chinese-language reports predicted that it would continue to use K2's Modified MIT license, and some articles listed additional clauses such as "synthetic data is not protected by the license." I compared the two original texts clause by clause: K3's license is not called Modified MIT; it has its own name and five clauses in total; and in K2's Modified MIT, the only modification is the attribution clause, with the agreement itself stating "the only modification we made is..."—there is no synthetic data clause at all.
Compared with K2, K3 genuinely adds two things, both of which warrant attention.
The first is the revenue threshold. If you are in the business of 'model-as-a-service,' the license defines it as providing third parties with access to model inference or fine-tuning in a manner that allows them to exercise substantial control over inputs, parameters, or training data.
"Model as a Service" means giving a third party access to language model inference or fine-tuning (e.g., via API) in a manner that allows such third party to exercise meaningful control over the inputs, parameters, or training data. This does not include (a) end-user products with model capabilities solely embedded within specific features or harnesses, or (b) mere relaying of requests to models hosted by others.
Only once you fall within this definition does the threshold come into play: when the aggregate revenue of you and your affiliates within any consecutive twelve-month period exceeds twenty million US dollars, you must first enter into a separate agreement with Moonshot AI before using this model or any derivative model thereof for any commercial purpose.
If the Licensee or any of its affiliates operates a Model as a Service business, and the aggregate revenue of the Licensee and its affiliates exceeds 20 million US dollars (or the equivalent in other currencies) in total over any consecutive 12 months, the Licensee must enter into a separate agreement with Moonshot AI before using the Software or its derivative works for any commercial purpose.
There are three points in this clause that are easy to overlook. First, the twenty million US dollars is calculated onyour company's total revenue, not the revenue of the model-service business line; the original text of the agreement refers to the total revenue of the licensee and its affiliates. A company with annual revenue of RMB 140 million will cross this line as soon as it launches an external model service, and such a company is not considered large in China. Second, the obligation is to sign first and then commercialize, not to sign retroactively after exceeding the threshold; the original text uses 'before.' Third, once triggered, what is restricted isanycommercial use, not merely the model-service portion.
Conversely, the agreement itself also clearly delineates what does not count as model-as-a-service: end products that embed model capabilities into specific functions do not count, and merely forwarding requests to a model hosted by another party does not count either. Therefore, ordinary SaaS tools, intelligent customer service, and copywriting generators generally do not fall within this clause. What truly requires careful consideration are API platforms and model-hosting platforms that open up custom parameters and fine-tuning capabilities to external users.
The second is the scope of the disclaimer. The disclaimer clause in K2 copies MIT, and its subject matter is 'this software'; K3 changes it to 'this software and any outputs and results thereof.'
THE SOFTWARE AND ANY OUTPUT AND RESULTS THEREFROM ARE PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL MOONSHOT AI OR ITS AFFILIATES OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
The difference of a few words plainly leaves the risk of infringement arising from model outputs and harm caused by outputs on the user's side. By way of analogy: a shopping mall gives you a kitchen knife for free, with a note saying 'the knife is delivered as is, and we accept no responsibility if you cut your hand'; if you use this knife to open a restaurant, food safety is your responsibility, not the knife-giver's. The analogy is not entirely precise, because the ways a kitchen knife can injure someone are foreseeable, whereas the risks of model outputs cannot be fully foreseen; but precisely because they cannot be foreseen, it is all the more necessary to fix in advance who bears them.
As for the attribution clause, K3 follows K2's threshold: if a commercial product exceeds 100 million monthly active users, or exceeds twenty million US dollars in monthly revenue, 'Kimi K3' must be prominently displayed on the interface. Most companies will not reach this, but service providers engaged in private deployment should pay extra attention to one point: if you deploy one instance for each of ten clients, how the user volumes on these instances are to be aggregated is not addressed by the agreement, which contains no affiliate aggregation rule; it is best to agree on this clearly in the delivery agreement first.
There is also a threshold question: this license has no signature from beginning to end, so on what basis does it bind you? The approach in Chinese judicial practice is that the rights holder's publication of the license along with the work constitutes an offer to unspecified persons, and your acts of downloading, deploying, and fine-tuning constitute acceptance, so that a contract is formed on the spot. More importantly, the phrase in the main text, 'subject to the following conditions,' is treated under Chinese law as a condition subsequent: if the condition is not fulfilled, the authorization automatically terminates, without the need for the licensor to give prior notice, and subsequent use, having lost its source of rights, falls directly into the infringement assessment of 'without permission.' This approach was established by the Luobox series of cases ((2019) Yue 73 Zhi Min Chu No. 207, (2021) Zui Gao Fa Zhi Min Zhong No. 2063). The consequence of overstepping is not something that can be resolved simply by paying a licensing fee.
Ultimately, this license answers only one question: whether you can use this model. It does not, and cannot, answer the other two questions.
Filing answers the question of whether you can provide the service to the public
The dividing line at this stage is whether you provide services to the domestic public.
If K3 is deployed only internally within a company, for its own employees to draft materials and conduct analyses, it generally does not constitute a service provider within the meaning of the Interim Measures for the Administration of Generative Artificial Intelligence Services. The Measures themselves state this:
Where industry organizations, enterprises, educational and research institutions, public cultural institutions, relevant professional institutions and others develop and apply generative artificial intelligence technology but do not provide generative artificial intelligence services to the domestic public, the provisions of these Measures do not apply.
Once the service is offered externally, the status changes. Moreover, "externally" here is broader than many people assume:
A generative artificial intelligence service provider means an organization or individual that uses generative artificial intelligence technology to provide generative artificial intelligence services (including providing generative artificial intelligence services by providing programmable interfaces and other means).
Under practical regulatory interpretation, a B2B model is not automatically excluded: where an enterprise customer uses your product to provide services to an unspecified public (typically customer-service products), you may still be deemed to be providing services to the domestic public. Internal testing or targeted public testing that reaches a certain scale may likewise be regarded as having already begun providing the service; encapsulating or nesting a third-party model and then offering it externally is counted in the same way.
Once the status is established, two procedures must be completed, collectively referred to in practice as "dual filing": algorithm filing is conducted through an online system and typically takes two to three months; large-model filing requires offline submission to the provincial cyberspace administration of the place where the entity is located, with dual review at the provincial and central levels, and typically takes six to eight months.
Here there is a trap specifically concerning "self-deploying open-source models." Regulators have left a simplified channel for enterprises that call third-partyalready-filedlarge models, called generative service registration, which requires only the consent of the provincial cyberspace administration of the place where the entity is located and involves much lighter materials. But this channel has two preconditions: what is called is a third-party model that has already completed filing, and you have not made adjustments to it that affect the generated content. Downloading the K3 weights and deploying them yourself does not itself constitute "calling a third-party already-filed model"; injecting vertical-domain corpus for fine-tuning even more clearly requires going through the filing procedure.
In other words, what using open-source models can save is the cost of API calls and the risk of data leaving the premises; what cannot be saved is precisely these six to eight months. Product scheduling must be calculated backward from this point.
Liability: answering "who pays when something goes wrong"
Having cleared the first two hurdles, one final question remains, and it is the one most in need of dispelling illusions: if the underlying layer uses someone else's open-source model, can liability be traced upstream when something goes wrong?
The answer is essentially no. The disclaimer clause above has already settled the matter: the risk of output remains on your side. The arrangement under PRC law points in the same direction, with responsibility as a network information content producer borne directly by the provider:
The provider shall, in accordance with the law, bear the responsibility of a network information content producer and perform network information security obligations. Where personal information is involved, it shall, in accordance with the law, bear the responsibility of a personal information processor and perform personal information protection obligations.
In day-to-day operations, there are three matters that cannot be avoided.
The first is the legality of the training corpus. What corpus you use to fine-tune K3, whether the source of that data is lawful, whether it infringes intellectual property rights, and whether consent has been obtained where personal information is involved, are all your own responsibility:
Generative artificial intelligence service providers (hereinafter referred to as providers) shall, in accordance with the law, carry out training data processing activities such as pre-training and optimization training, and comply with the following provisions: (1) use data and foundation models with lawful sources; (2) where intellectual property is involved, not infringe the intellectual property rights lawfully enjoyed by others; (3) where personal information is involved, obtain the individual's consent or meet other circumstances prescribed by laws and administrative regulations; (4) take effective measures to improve the quality of training data and enhance the authenticity, accuracy, objectivity and diversity of training data; (5) other relevant provisions of laws and administrative regulations such as the Cybersecurity Law of the People's Republic of China, the Data Security Law of the People's Republic of China and the Personal Information Protection Law of the People's Republic of China, and relevant regulatory requirements of the competent authorities.
What responsibility Moonshot AI bears for pre-training data is another matter and has nothing to do with the batch of corpus you inject.
The second is the handling of illegal content:
Where a provider discovers illegal content, it shall promptly take disposal measures such as stopping generation, stopping transmission and elimination, take measures such as model optimization training to carry out rectification, and report to the competent authorities.
The third is the labeling obligation, and this provision has been strictly enforced since September 1, 2025. The Measures for Labeling Artificial Intelligence-Generated Synthetic Content require the addition of implicit labels in file metadata:
Service providers shall, in accordance with Article 16 of the Provisions on the Administration of Deep Synthesis of Internet Information Services, add implicit labels to the file metadata of generated synthetic content; implicit labels include attribute information of the generated synthetic content, the name or code of the service provider, the content number, and other production element information.
Note that this paragraph is mandatory, whereas the digital watermark referred to in paragraph 2 of the same article is merely encouraged:
Service providers are encouraged to add implicit labels in the form of digital watermarks and the like to generated synthetic content.
The two have different legal force; treating watermarks as a mandatory obligation is a common misreading. Explicit labels have a separate precondition: they are triggered only where the circumstances in Article 17, paragraph 1 of the Provisions on the Administration of Deep Synthesis of Internet Information Services are met and the content "may cause public confusion or misidentification."
These obligations do not remain on paper. The Guangzhou Internet Court case (2024) Yue 0192 Min Chu No. 113 is the first publicly reported AIGC service infringement case in China; the defendant platform, at a user's instruction, generated images substantially similar to Ultraman, and the court found that it infringed the rights of reproduction and adaptation, awarded damages of RMB 10,000, and ordered keyword filtering to ensure that "where a user uses Ultraman-related prompt words in normal use, images substantially similar to the Ultraman works at issue cannot be generated." The damages amount is not high; what truly merits attention are the several deficiencies the court listed when finding the platform at fault: no keyword filtering or content review, a lack of a complaint and reporting mechanism, no risk warnings, and no prominent labeling. That list of "what was not done" is essentially a ready-made checklist.
Enforcement is equally unambiguous. In April 2025 the Cyberspace Administration of China launched the "Qinglang - Cracking Down on Abuse of Artificial Intelligence Technology" special action, and in June of the same year reported the results of the first phase: more than 3,500 AI products such as non-compliant mini-programs, applications and agents were handled, and more than 3,700 accounts were handled. Of the four enforcement priorities, the first two are product market-access compliance and training-corpus compliance.
Three kinds of companies, three different focal points
The weight of the three thresholds is not the same for companies of different sizes.
Small teams and newly launched products do not meet either threshold for a license, so there is no need to spend time agonizing over it; what genuinely needs to be done is filing, and six to eight months must be reserved at the product scheduling stage. When listing on app stores and mini-program platforms, they will usually first ask you for an algorithm filing number. Do not understand "the model is free" as "the formalities are also waived"; among the products handled in the past two years, a considerable portion of the problems arose at precisely this step.
Companies that already have scale should first do two calculations. One is to add up the company's revenue together with that of its affiliates over the most recent twelve months to see whether it exceeds the USD 20 million line, while confirming whether their business model falls within the agreement's definition of model as a service; if the line is crossed and the definition is met, a contract must be negotiated before commercial use. The other is to confirm the fine-tuning plan: as long as it involves training that affects generated content, the shortcut of simplified registration is unavailable.
Service providers engaged in integration and private deployment are in the most complex position, having to interface with both upstream and downstream. Upstream, the usage restrictions, attribution thresholds and disclaimers in the license must be passed through verbatim into the service terms you sign with customers; do not make commitments beyond the scope of your own rights. Downstream, what scenarios the customer uses your product for and whether that counts as providing to the public directly determines on whom the filing obligation falls; this is best spelled out in the contract rather than argued about after a problem arises. The same applies to how user volumes are aggregated across multiple customers and multiple instances.
Ordinary users need to know only one thing: the "AI-generated" label in content is not an optional action of the platform but a statutory obligation, and maliciously deleting, tampering with or concealing such labels is also expressly prohibited.
Open source lowers the barrier to entry
The value of open-source models is real: they reduce the cost of accessing frontier capabilities to near zero and also solve the long-standing problem that data must leave the premises. But what they lower is the barrier to entry, not the barrier to market access. The weights can be downloaded for free, but liability does not transfer along with the weights.
Licenses address "whether it can be used," filing addresses "whether it can be provided to the public," and legal liability addresses "who pays when something goes wrong." Three locks, and not one of them can be omitted. If there is any shortcut at all, it is to put these three matters in the product initiation column rather than leaving them until the week before launch.
For enterprises that integrate open-source large models to provide services to the public, every link—from license review and the design of the dual filing path to the allocation of liability through user agreements and delivery contracts—offers room to lock things down in advance. If you have a specific project to implement, you are welcome to leave a message in the backend to discuss.
Reference sources
- Official text of the Kimi K3 License, Moonshot AI HuggingFace repository moonshotai/Kimi-K3
- Official text of the Kimi K2 Modified MIT License, Moonshot AI HuggingFace repository
- Official announcement and technical blog of the Moonshot AI Kimi K3 Open Day
- License files of the MoonEP, FlashKDA, and AgentENV repositories (all MIT)
- Interim Measures for the Administration of Generative Artificial Intelligence Services, Order No. 15 of the Cyberspace Administration of China and six other departments
- Measures for the Labeling of AI-Generated Synthetic Content, Cyberspace Administration of China and three other departments
- Provisions on the Administration of Deep Synthesis of Internet Information Services, Cyberspace Administration of China and two other departments
- Provisions on the Administration of Algorithmic Recommendations in Internet Information Services, issued by the Cyberspace Administration of China and three other departments
- Guangzhou Internet Court (2024) Yue 0192 Min Chu No. 113 Civil Judgment
- Guangzhou Intellectual Property Court (2019) Yue 73 Zhi Min Chu No. 207 and Supreme People's Court (2021) Zui Gao Fa Zhi Min Zhong No. 2063 Civil Judgments
- First-Phase Report of the Cyberspace Administration of China's Special Action "Qinglang: Cracking Down on Abuse of Artificial Intelligence Technology"
- Open Source Initiative (OSI) Open Source AI Definition 1.0
Author of this article:Lü Yinghui, a lawyer at Mankun (Shenzhen) Law Firm. A graduate of China University of Political Science and Law, with nearly ten years of deep experience in the legal industry, including prior work at a Shenzhen court. Focused on legal services for the new-generation economy, with extensive practical experience and deep insight in fields such as Web3 and artificial intelligence. Account across all platforms: Lao Lü Talks New Money; you are welcome to follow.
