Kimi K3 Is Open-Weight. Its Commercial Terms Depend on Use.

Moonshot AI's public Kimi K3 repository, updated July 27, 2026, makes the model's weights available under a custom license. Open-weight access expands what a team can inspect and operate, but which license provisions apply depends on the serving relationship: internal use, a model embedded in a product feature, a mere relay to another host, access through Moonshot AI's official products or certified inference partners, and third-party access to inference or fine-tuning with meaningful control over inputs, parameters, or training data do not receive identical treatment.

A business should therefore classify the intended path before it benchmarks Kimi K3 or commits infrastructure money. This article explains the license text that drives that classification, keeps its two $20 million tests separate, and shows what engineering, product, procurement, and counsel need to settle first. It is a technical and commercial reading of the published terms, not legal advice.

The license grants broad rights and then defines a specific MaaS boundary

The Kimi K3 License grants rights to use, copy, modify, merge, publish, distribute, sublicense, sell, run, deploy, fine-tune, and create derivatives, subject to its conditions. Copies or substantial portions must retain the copyright and permission notices, and use must comply with applicable law. The software, outputs, and results are also provided as-is under the license's warranty and liability disclaimer.

The custom terms turn on the license's definition of Model as a Service, or MaaS. It covers giving a third party access to inference or fine-tuning, including through an API, when that party has meaningful control over inputs, parameters, or training data. The definition excludes an end-user product where the model's capabilities are solely embedded in specific features or harnesses, and it separately excludes merely relaying requests to a model hosted by someone else.

These distinctions make the product and data flow part of the license analysis. A team cannot classify its use from the words “API,” “platform,” or “embedded AI” on a roadmap. It needs to establish who hosts the weights, what the customer can control, and whether the application confines the model to a specific feature.

The two $20 million tests measure different businesses and time periods

The MaaS revenue condition applies if the Licensee or any of its affiliates operates a MaaS business and the aggregate revenue of the Licensee and its affiliates exceeds $20 million in total over any consecutive 12 months. When both conditions are met, the Licensee must enter into a separate agreement with Moonshot AI before using Kimi K3 or its derivative works for any commercial purpose. The threshold aggregates the Licensee's revenue with its affiliates' revenue; it is not limited to model revenue or MaaS revenue, and it is not a monthly threshold.

A separate branding condition applies when Kimi K3 or a derivative work is used in any of the Licensee's commercial products or services. If such a product or service has more than 100 million monthly active users or more than $20 million in monthly revenue, “Kimi K3” must be displayed prominently in its user interface. The user and revenue thresholds are alternatives, so crossing either one can trigger the branding requirement.

The license then exempts internal use from both the MaaS and branding provisions. It defines internal use as use that does not make the software, outputs, or underlying capabilities available to third parties. Access through Moonshot AI official products or certified inference partners is also exempt from those two provisions, although the public license does not identify which providers are certified.

Four deployment paths produce different license questions

The comparison below applies the published language to four common architectures. It identifies the term that needs review; it does not decide how the license applies to a particular product.

Scroll sideways to see all 3 columns.

Deployment path	What the published license says	What the team must confirm
Internal self-hosting	The MaaS and branding provisions do not apply when the software, outputs, and underlying capabilities are not made available to third parties. Notice, applicable-law, and other license conditions remain.	Whether any customer, partner, contractor, or other third party receives outputs or access that takes the use outside the license's internal-use definition.
Embedded end-user feature	A product is excluded from MaaS when the model's capabilities are solely embedded in specific features or harnesses. The separate user-interface branding test can still apply unless another exemption covers the use.	Whether product controls actually confine the model to the feature, and whether the product exceeds 100 million monthly active users or $20 million in monthly revenue.
Mere relay, Moonshot AI official product, or certified inference partner	Mere relaying requests to a model hosted by someone else is excluded from MaaS. Use of Kimi K3 through a Moonshot AI official product or certified inference partner is separately exempt from the MaaS and branding provisions.	Whether the application is only a relay; whether access uses a Moonshot AI official product; and, for a third-party host, whether Moonshot AI has confirmed that it is currently a certified inference partner. One condition does not establish another.
Self-hosted, customer-controlled MaaS	Customer access to inference or fine-tuning most directly fits MaaS when customers meaningfully control inputs, parameters, or training data. The aggregate company-and-affiliate revenue condition and the separate product branding condition must be assessed independently.	The exact customer controls, aggregate licensee-and-affiliate revenue across any consecutive 12 months, product monthly active users and monthly revenue, and whether a separate Moonshot agreement is required.

The exemption for use through Moonshot AI's official products or certified inference partners deserves particular care. A provider can offer Kimi K3 without the public license itself establishing that the provider is a certified inference partner. Procurement should obtain current confirmation from Moonshot AI and review the provider terms for the exact endpoint instead of treating model availability as proof of certification.

The published terms leave important product boundaries unresolved

The license does not define how much control becomes “meaningful,” where a flexible embedded feature becomes general inference access, or how to classify every combination of application logic and user-supplied data. Those are material gaps because small product changes can alter the relationship between the user and the model. A constrained summarization feature and an interface that exposes broad parameter or fine-tuning controls may use the same weights while presenting different facts under the MaaS definition.

“Mere relaying” also describes a function, not every application that forwards a request. A product may add orchestration, storage, retrieval, tools, parameter controls, or a customer-facing service commitment around a hosted model. The public text does not say where every such arrangement stops being a mere relay, so teams should document the actual behavior and have counsel assess it instead of relying on a marketing category.

The internal-use exemption has a similarly exact boundary: software, outputs, and underlying capabilities must not be made available to third parties. The license text supplies that definition, but it does not resolve every relationship involving affiliates, contractors, customers, or externally delivered work. Counsel can interpret those facts; engineering and product must first make them visible.

License classification should precede performance and infrastructure work

Kimi K3 is large enough for this dependency order to matter. Moonshot AI's model repository and card describe a 2.8-trillion-parameter mixture-of-experts model with 104 billion active parameters and point deployers to engine-specific recipes. The vLLM recipe lists at least eight GB300 accelerators, or at least eight MI355X/MI350X accelerators for its ROCm path. That is a requirement for the named vLLM recipe and hardware, not a universal Kimi K3 minimum. SGLang's cookbook separately labels its 16–64 GPU Blackwell configurations as large-scale serving presets; its deployment table also includes eight-accelerator shapes for B300, GB300, MI350X, and MI355X. These are vendor-published architecture and deployment claims, not independent evidence of production performance or cost.

A sum of the public repository file tree on July 28 found 96 Safetensors shards totaling about 1.56 TB. That is checkpoint file size, not required accelerator memory, active compute, runtime cache, or a complete serving budget. Our analysis of Inkling's deployment requirements explains why checkpoint access, active parameters, memory format, and runtime headroom must remain separate when estimating a large open-weight deployment.

Those facts do not argue against testing Kimi K3. They show why a team should avoid funding the wrong test. An internal cluster evaluation, a provider-hosted embedded feature, and a self-hosted customer MaaS create different legal, technical, and operating work even when they start with the same model.

A short cross-functional review can classify the path

Work through the serving relationship in dependency order before approving a benchmark:

1. Engineering documents where the weights run, where requests and outputs travel, and which inputs, parameters, or training data a third party can control.
2. Product states whether the capability stays inside a specific feature or harness, who receives the outputs, and whether prominent “Kimi K3” attribution would be acceptable in the interface.
3. Procurement confirms whether access uses a Moonshot AI official product or a currently certified inference partner, then preserves the applicable provider terms and license version.
4. Finance supplies aggregate licensee-and-affiliate revenue for the relevant consecutive 12-month periods, plus the product or service's monthly revenue and monthly active users. The team applies the two threshold tests separately.
5. Counsel reviews the documented facts and unresolved terms. Engineering, product, and procurement should repeat that review when hosting, customer controls, provider status, or commercial scale changes.

This sequence prepares a concrete architecture and commercial record for legal review; it does not replace one. Once counsel and the accountable business owners confirm a viable path, the team can benchmark that exact path instead of evaluating a deployment it may later need to redesign.

Commercial permission and production ownership remain separate decisions

A cleared license path still needs owners for serving, security, updates, data handling, monitoring, recovery, provider changes, and cost. Downloadable weights answer an access question. Our broader guide to the open-model production ownership gap explains the work that remains after access and task quality are established.

BaristaLabs can help a team review one Kimi K3 deployment path across architecture, provider terms, infrastructure, and operating ownership, with legal conclusions left to counsel. Our AI consulting service is suited to teams that need the technical and commercial facts organized before they fund a model test or migration.

Decision rule: if the team cannot state who hosts Kimi K3, what third parties can receive or control, which provider status applies, and which revenue test is relevant, do not approve benchmark or infrastructure spend. Once those answers have been reviewed, fund only the deployment path covered by that review.