Kimi K2 is not a vLLM problem. It's a sovereignty, MoE-reliability, and license-review problem — and here's the framework no vendor guide gives you.
August 2, 2026 is when EU regulators gain enforcement powers over GPAI — and when downstream banks, insurers, and hospitals get the first knock, not the model vendors.
The on-premise AI vs cloud AI question isn't philosophical. Seven workload tests produce a deterministic placement verdict — no hybrid handwave required.
Workload-classification rubric, GPU break-even math, and the CISO provenance checklist for choosing between self-hosted Kimi K2 and GPT-5 in EU regulated industries.
Why the AI Act's open-source carve-out collapses the moment a regulated buyer fine-tunes — and the four-vector diligence pass that replaces it.