Audience: Engineers deploying Kimi K3, compliance officers evaluating Chinese-origin open-weight models, security teams assessing supply chain risk for large-scale MoE deployments.
EU AI Act enforcement is live. GPAI obligations enforce August 2, 2026. K3 is a general-purpose AI model under Art. 51. Deployers of GPAI models bear compliance obligations regardless of the model's country of origin. The governance pattern is model-agnostic. SWT3 does not know or care who built the model. It records what happened and produces verifiable evidence.
| Attribute | Value |
|---|---|
| Parameter count | 2.8 trillion (MoE) |
| Active parameters | ~400B per inference (estimated) |
| Expert count | 896 |
| Context window | 1 million tokens |
| Architecture | Mixture of Experts (MoE) |
| License | Apache 2.0 |
| Provider | Moonshot AI (Beijing, China) |
| Open weights release | July 27, 2026 |
| API compatibility | OpenAI-compatible |
| Serving | vLLM, SGLang, native API |
K3 is the world's first open 2.8T model. At 896 experts, it represents the largest openly available mixture-of-experts architecture. The Apache 2.0 license allows unrestricted commercial use. Open weights ship with zero built-in governance controls.
SWT3 closes this gap. Every inference is recorded in a cryptographically signed SWT3 Witness Anchor. The anchor is independently verifiable and exists outside of Moonshot AI's infrastructure. You own the evidence chain.
Country of origin does not change governance obligations. A model built in Beijing, deployed in Frankfurt, serving customers in New York has obligations under EU AI Act, US executive orders, and potentially Chinese regulations simultaneously.
K3 qualifies as a general-purpose AI model under EU AI Act Art. 51. It may also qualify as a GPAI model with systemic risk under Art. 51(2) given its 2.8T parameter count and general-purpose capabilities. Systemic risk classification triggers additional obligations under Art. 55, including adversarial testing and incident reporting.
Deployers should verify that their use case does not trigger export control restrictions (EAR, Entity List). SWT3 provides evidence of deployment context but does not provide legal analysis. Consult export control counsel before deploying K3 in regulated industries or to restricted end users.
China's Interim Measures for Generative AI (effective July 2025) require service providers operating within China to register models. Deployers outside China using open-weight K3 weights are not directly subject to these registration requirements, but awareness of the regulatory landscape informs supply chain risk assessment.
The governance pattern is model-agnostic. SWT3 does not know or care who built the model. It records what happened and produces verifiable evidence. The same SWT3 Witness Anchor format applies to K3 deployed in Frankfurt as it does to Claude deployed in us-east-1.
K3 context: At 896 experts with dynamic routing, each inference activates a different subset of the model. Without provenance records, there is no way to reconstruct which expert combination processed a given request. AI-INF.1 records the model identifier, input/output hashes, latency, and serving endpoint for every inference.
AI-INF.1 anchors prove that a specific inference occurred at a specific time through a specific K3 deployment. The anchor exists independently of Moonshot AI's infrastructure. Check that model_id in each anchor resolves to a known K3 version identifier.
K3 context: K3 ships without built-in safety filters. Unlike Claude or GPT-4, there is no provider-side content filtering. Deployers must implement their own guardrails (Llama Guard, NeMo Guardrails, custom classifiers) and prove they were active at inference time.
AI-GRD.1 evidence shows guardrail status per inference. A pattern of guardrailsActive = false indicates unprotected inferences from a 2.8T model with no built-in safety layer. This is a finding under EU AI Act Art. 9 for any high-risk use case.
K3 context: 2.8T parameters distributed across potentially hundreds of shard files. The weights hash proves which exact version is deployed. Any modification (fine-tuning, quantization, or tampering) produces a different hash. This is especially critical for models distributed through third-party mirrors where provenance is harder to verify.
Compare the recorded weights hash against the published hash from Moonshot AI or Hugging Face. For a 2.8T model, the integrity chain is especially important given the infrastructure required to host it. A mismatch indicates either a modified model or an undocumented quantization.
K3 context: The supply chain for K3 includes model weights (Moonshot AI, Hugging Face mirrors), serving framework (vLLM, SGLang), compute dependencies (CUDA, PyTorch), and container images. For Chinese-origin models, supply chain documentation is particularly important for demonstrating due diligence to auditors and security reviewers.
AI-SUPPLY.1 anchors document the full provenance chain: weights source, framework version, dependency manifest. Compare against published checksums from Moonshot AI. Any gap in the chain is a finding under NIST AI RMF GOVERN 1.4 and EU AI Act Art. 53(1)(a).
K3 context: A 2.8T model with general-purpose capabilities and no built-in restrictions has inherent dual-use potential. AI-DUALUSE.1 records the deployer's risk assessment for dual-use scenarios, documenting what use cases are permitted, what restrictions are in place, and what monitoring exists for misuse detection.
AI-DUALUSE.1 anchors prove that the deployer assessed dual-use risk before deployment. Required for GPAI models with systemic risk under EU AI Act Art. 55(1)(a). Absence of this record is an automatic finding for any K3 deployment assessed under EU AI Act obligations.
Both patterns produce identical SWT3 Witness Anchors. The evidence chain is the same whether K3 runs on OpenRouter infrastructure or your own GPU cluster. Install the SDK: pip install swt3-ai. Get an API key at /signup.
| Framework | Relevant Requirements | SWT3 Evidence |
|---|---|---|
| EU AI Act (GPAI) | Art. 51 GPAI classification, Art. 53 technical documentation, Art. 55 systemic risk | AI-INF.1, AI-MDL.1, AI-DUALUSE.1 |
| EO 14110 (superseded June 2026) | Dual-use foundation model reporting, safety evaluations | AI-DUALUSE.1, AI-GRD.1, AI-INF.1 |
| NIST AI RMF | MAP 1.5 risk identification, MEASURE 2.6 bias, GOVERN 1.1 accountability | AI-GRD.1, AI-INF.1, AI-SUPPLY.1 |
| ISO 42001 | 6.1 risk assessment, 8.4 data management, 9.1 monitoring | AI-INF.1, AI-MDL.1, AI-GRD.1 |
Explore all framework crosswalks in the crosswalk explorer, including EU AI Act GPAI obligations and NIST AI RMF procedure mappings.
| Model | Provider | Parameters | License | Governance Controls | SWT3 Integration |
|---|---|---|---|---|---|
| K3 | Moonshot AI | 2.8T MoE | Apache 2.0 | None | wrap(OpenAI(...)) |
| Llama 4 | Meta | 109B-400B | Llama License | None | wrap(OpenAI(...)) |
| DeepSeek V3 | DeepSeek | 685B MoE | MIT | None | wrap(OpenAI(...)) |
| Inkling | Thinking Machines | 975B MoE | Apache 2.0 | None | wrap(OpenAI(...)) |
All open-weight models produce identical SWT3 Witness Anchors. The governance pattern is model-agnostic.
| Examiner Question | SWT3 Evidence | Procedure |
|---|---|---|
| What model version processed this request? | Anchor model_id field, cross-referenced to weights hash |
AI-INF.1, AI-MDL.1 |
| Were safety controls active during inference? | Per-inference guardrailsActive flag in anchor payload |
AI-GRD.1 |
| Has the model been modified from published weights? | SHA-256 weights hash compared to Moonshot AI published checksum | AI-MDL.1 |
| Where did the model weights come from? | Supply chain manifest in AI-SUPPLY.1 anchor: source URL, mirror hash, framework version | AI-SUPPLY.1 |
| Was dual-use risk assessed before deployment? | AI-DUALUSE.1 anchor with timestamp predating first inference anchor | AI-DUALUSE.1 |
| Can you reconstruct the inference timeline? | Ordered anchor sequence by epoch timestamp, each with SHA-256 fingerprint | AI-INF.1 |
| What is the GPAI evidence package? | Export from /api/v1/ai-witness/export: full anchor chain, procedure map, framework crosswalk |
All |