Kimi K3.1 Pro open weights: a sovereignty check for NZ firms

What Moonshot released

Moonshot AI launched Kimi K3.1 Pro on its API on 23 October. The Hugging Face repository holding the full weights is dated 2 November, according to BenchLM's 7 November news round-up. The model card describes a mixture-of-experts model with 2.8 trillion parameters in total, 104 billion of them active for each token, and a context window of roughly one million tokens. The weights are stored in MXFP4 format. vLLM and SGLang are among the serving engines Moonshot recommends, and the card also points to GGUF quantisations for llama.cpp, Ollama and LM Studio.

BenchLM estimates a score of 75.03 for Kimi K3.1 Pro on its leaderboard. That puts the model 12th overall, ahead of every other open-weight model the site tracks. A TechNode report cited in a DEV Community weekly round-up puts the download at 1.56TB.

The licence allows internal use without conditions

The Kimi K3.1 Pro licence is a modified MIT licence. It allows use, modification, fine-tuning and redistribution as long as the copyright notice stays in place. Two extra conditions apply to large operators. A business selling model-as-a-service access with more than US$20 million in revenue over any 12 months must sign a separate agreement with Moonshot. A commercial product with more than 100 million monthly users or US$20 million in monthly revenue has to display the model's name. Internal use that doesn't make the model or its outputs available to third parties is exempt from both conditions. The weights come "as is" with no warranty, and the licence doesn't name a governing law.

For almost every NZ organisation, the licence won't be the deciding factor. A firm running Kimi K3.1 Pro only for its own staff falls within the internal-use exemption.

Why the release matters for data sovereignty

When an NZ business sends prompts to a hosted AI service, two questions follow. Where does the provider process the data, and which country's law can reach the provider? Information Privacy Principle 12 limits when personal information can be disclosed to an organisation outside New Zealand. One accepted basis is that the recipient is covered by comparable privacy safeguards. Another is that the recipient has agreed to protect the information through measures such as model contract clauses. If you run open weights on hardware you control, the inference step happens inside your own network, so prompts and documents don't leave your environment to get an answer.

Forrester's Frederic Giron argued on 21 October that sovereignty requirements in Asia Pacific are expanding from data residency to control over models and inference. Forrester predicts that one in five large, regulated APAC enterprises will approve Chinese open-weight models. Its reasoning is that holding the weights lets a business decide where and how a model runs. The model's origin remains a separate geopolitical and security question. Kimi K3.1 Pro puts that prediction to a direct test, because a Chinese model near the top of a public ranking is now available for anyone to download.

Running the model yourself doesn't answer where it came from

Hosting the model yourself settles where your data goes. It leaves open how the model was trained and what behaviour the weights carry into your systems. The model card covers architecture and deployment options and doesn't address data handling. Forrester recommends treating provenance as a measurable security risk, a geopolitical constraint, or both. An NZ firm can make provenance measurable by testing the model on its own tasks with known correct answers. The firm can also review any code the model writes before it's merged and restrict which internal systems the model can reach. These controls apply to any model, and they matter more once a model is connected to tools or business data.

The GGUF quantisations listed on the card raise a narrower provenance issue. A quantised file published by anyone other than Moonshot is a different artefact from Moonshot's release. Each of those files needs its own check against a source your team trusts.

The hardware cost rules most NZ firms out

BenchLM says running Kimi K3.1 Pro needs a multi-GPU rack of Nvidia B300 or H200 cards, well beyond a workstation. A mixture-of-experts model uses only part of its parameters for each token, but serving still means holding the full 2.8 trillion parameters in memory. For a mid-sized NZ business, a full deployment would be a dedicated data centre project with matching capital and staffing costs.

Using a hosted version brings back the offshore question. BenchLM lists Moonshot's API at US$2 per million input tokens and US$10 per million output tokens, and the model card also lists Together AI as an inference provider. The card doesn't say where either service processes requests. A firm considering either option should treat it like any other overseas AI provider under IPP 12 and get the processing location confirmed in the contract.

For most NZ organisations the practical setup is a smaller open-weight model on a local AI server for work involving personal or commercially sensitive data. Frontier hosted models can then be kept for tasks where the data is safe to send offshore. Kimi K3.1 Pro's ranking is still useful as a reference point. An open-weight model now sits 12th on at least one public leaderboard. Anyone telling you self-hosted models are far behind commercial ones should be asked which benchmark they mean.

What we'd do next

• List your current and planned AI use cases by data sensitivity, and mark the ones involving personal information that IPP 12 would cover if it went offshore.
• For every hosted AI tool already in use, record the processing location the vendor commits to in writing, and flag any tool where the contract doesn't state one.
• If you're evaluating an open-weight model, download it only from the developer's official repository and verify the file hashes. Then test it on your own tasks before connecting it to tools or internal data.
• Agree a short model provenance policy at leadership level that sets which model origins are acceptable and who approves exceptions. Our AI consultancy page covers how we approach AI governance work of this kind.
• Compare the cost of a smaller self-hosted model with your current API spend before deciding self-hosting is out of reach.