Two developments coincide this week: tomorrow (27 July) the open weights of Kimi K3 will appear on Hugging Face, and in seven days, on 2 August, Article 50 of the EU AI Act takes effect. That is no coincidence: it is precisely the moment to decide whether to deploy a closed or an open model, and why.
Kimi K3: the largest open model yet
Moonshot AI announced Kimi K3 on 16 July as an API model. The open-weights release on 27 July is what makes it interesting for European organisations. It is a sparse Mixture-of-Experts model with 2.8 trillion parameters and a context window of 1 million tokens, enough for a complete codebase or an extensive dossier in a single call.
On benchmarks such as the Mathematics Olympiad and competitive coding, Kimi K3 scores in line with Claude Opus 5 and GPT-5.6 Sol, reports llm-stats.com. In practice that means frontier-level reasoning, now as software you can self-host.
The GDPR calculation for self-hosting vs. API
The Moonshot API processes data on servers in China. The European Commission has no adequacy decision for China, and Moonshot has not published Standard Contractual Clauses for EU customers. That effectively makes the hosted API unusable if you process personal data, a conclusion we already drew at the launch on 16 July (see also our safety profile).
Self-hosting with the open weights changes that: the data never leaves your own infrastructure. That makes Kimi K3 a serious option for GDPR-conscious organisations, provided you can clear the technical hurdle.
What you need: 1.4 TB of stored model weights. For inference you need a multi-GPU setup, with quantisation to MXFP4 you land at roughly 350–400 GB of GPU memory. That is not a laptop project, but for a data centre or cloud environment (your own EU region) it is feasible. Layer3 Labs describes the steps for regulated businesses.
Point of attention: the definitive licence terms for Kimi K3 had not been published at the time of writing. Kimi K2 used an MIT-like licence with commercial restrictions above a certain scale. Check the licence on Hugging Face before going into production.
Article 50 in seven days: the basics
From 2 August the AI Act transparency obligation applies. It affects virtually every organisation that deploys an AI chatbot or virtual assistant:
- Chatbots and voicebots must disclose at the start of each conversation that they are AI.
- AI-generated content (text, image, audio, video) must be labelled as synthetic, insofar as technically feasible.
- Systems with emotion recognition or biometric categorisation must inform the person concerned.
This applies to all organisations deploying AI systems towards end users in the EU, regardless of size. Fines can reach €15 million or 3% of worldwide annual turnover, on top of any GDPR fines. The high-risk AI obligations (Annex III) have been postponed via the Digital Omnibus to 2 December 2027, confirms Gibson Dunn.
See our overview of AI Act obligations by sector for a sector-specific checklist.
Practically: what do you do this week?
If you deploy an AI chatbot or assistant towards customers or staff:
- Check that the AI identifies itself as AI at the start of every interaction.
- Make sure AI-generated outputs are recognisable as such (watermark, label or disclaimer).
- Document which models you use and where they process data, this also helps with any GDPR accountability.
If you're considering Kimi K3: wait for the final licence (expected 27 July), and weigh self-hosting on EU infrastructure against the operational costs. For sectors that handle a lot of personal data, healthcare, legal, HR, self-hosting is the only GDPR-compliant route as long as Moonshot does not publish an EU data processing agreement.
Compare Kimi K3 with other open models on our model overview page, or see what AI use looks like per sector on the sector pages.
Sources
- Moonshot AI: Kimi K3 tech blog
- Layer3 Labs: Kimi K3 open weights guide for regulated businesses
- TechTimes: Self-hosting cuts China data risk
- Gibson Dunn: EU AI Act Omnibus, postponed deadlines
- llm-stats.com: LLM News Today July 2026