API Access and Usage Policy Reference

What it is

The card discloses that the model is available both via Mistral AI's API and as downloadable open weights, and references mistral.ai/terms as the governing usage policy for both access modes.

Why it matters (compliance & governance perspective)

The dual-access structure (API and open weights) creates two distinct contractual and governance relationships: API users are bound by Mistral AI's terms of service and usage policies as enforced through platform controls, while open-weights deployers operate under the Modified MIT License with usage policy obligations that are contractually rather than technically enforced.

Consumer impact (what this means for users)

Under these terms, organizations accessing the model via API are subject to Mistral AI's platform-enforced usage policies, while those using open weights operate under a license structure where compliance with usage restrictions depends on the deployer's own adherence to the referenced terms rather than technical enforcement by Mistral AI.

What you can do

Institutional analysis (Compliance & governance intelligence)

1. REGULATORY LANDSCAPE: The API access mode subjects users to Mistral AI's data processing terms, which for EU users would engage GDPR's controller-processor framework and require a data processing agreement. The open-weights access mode does not create a direct data processing relationship with Mistral AI but does not relieve deployers of their own GDPR obligations for data processed through deployed applications. The FTC's guidance on AI products and services is relevant to both access modes for US-based users. 2. GOVERNANCE EXPOSURE: Medium. Organizations that have not formally reviewed and accepted the terms at mistral.ai/terms before deploying the model via API may be operating without a clearly documented contractual basis. Compliance teams should confirm that relevant data processing agreements are in place for API-based deployments. 3. JURISDICTION FLAGS: EU deployers using the API must ensure a data processing agreement is in place with Mistral AI that satisfies GDPR Article 28 requirements. Open-weights deployers in the EU bear full controller responsibilities for data processed through their deployed applications without a Mistral AI processing relationship. 4. CONTRACT AND VENDOR IMPLICATIONS: Vendor management teams should categorize Mistral AI as a data processor for API-based deployments and ensure appropriate contractual documentation is in place. Open-weights deployments do not create a vendor relationship with Mistral AI for data processing purposes, which affects vendor risk assessment and audit right structures. 5. COMPLIANCE CONSIDERATIONS: Organizations should: (a) confirm which access mode they are using and identify the applicable contractual framework; (b) for API access, execute any required data processing agreements and review the terms at mistral.ai/terms; (c) for open-weights access, confirm the Modified MIT License terms are met and that no data processing relationship with Mistral AI exists that requires documentation; (d) update vendor registries and data processing records accordingly.

Applicable agencies

Provision details

Other risks in this policy

• Modified MIT License for Open Weights medium
• Prohibited Use Categories high
• Deployer Responsibility for Downstream Safety high
• EU AI Act General-Purpose AI Classification high
• Model Technical Specifications and Context Window medium
• Safety Training and System Prompt Override Resistance medium