GLM-5.3

As an AI consultancy from Rosenheim, we support companies in Germany, Austria and Switzerland with the GDPR-compliant use of open-weight models. For Z.ai’s (Zhipu AI) GLM family, both GLM-5.3 and GLM-5.3-Flash are available as open weights – under two different licences, however. This overview reflects the state as of October 2026.

GLM at a glance

• GLM-5.3 (API since 14 Aug 2026) has also been available as open weights on Hugging Face since the end of August 2026 – not under MIT, but under the bespoke GLM-5.3 License. The official per-token price is listed in the Z.ai price list.
• GLM-5.3-Flash (26 Aug 2026) is the first natively multimodal model of the GLM-5 series (text, image, video), considerably leaner than the flagship at 320B parameters (18B active), and released under the MIT licence.
• GLM-5.2 (June 2026) remains available as the last MIT-licensed flagship, but has been surpassed by GLM-5.3 on the benchmarks.
• Independent measurements by Artificial Analysis are available for both models (Intelligence Index v4.1.1: GLM-5.3 60, GLM-5.3-Flash 57).

GLM-5.3 – flagship with open weights and a bespoke licence

GLM-5.3 was released on 14 August 2026, initially via API only. The way it got there is notable: Z.ai did not retrain the GLM-5.2 base model. According to the vendor, all gains come from scaled post-training. The Hugging Face model card lists the model at 753B parameters (Mixture-of-Experts).

The jumps Z.ai reports mainly concern agentic tasks:

Context: these are vendor figures. An independent measurement exists as well: on the Artificial Analysis Intelligence Index v4.1.1, GLM-5.3 scores 60 points (GLM-5.2: 53). At the same time, Artificial Analysis flags the model as very token-intensive – around 170M output tokens for the index versus a median of 110M – at a measured output speed of around 63 tokens/s. The Terminal-Bench 3.0 numbers are also not comparable to the older Terminal-Bench 2.x figures; the benchmark generation is considerably harder.

Technical specs (per docs.z.ai)

• 1M token context window, up to 128k token output
• Three reasoning effort levels: low, high and max – max is the default and is recommended for complex coding
• Reasoning can no longer be switched off: integrations using thinking.type: "disabled" must move to enabled with reasoning_effort: "low" before upgrading
• Function calling, context caching, structured output, streaming
• Text input only – for image and video see GLM-5.3-Flash
• Protocols: OpenAI Chat Completion, OpenAI Response and Anthropic Messages

The weights are out – the licence is new

Z.ai had postponed the release of the weights by roughly two weeks to complete a safety evaluation. The background was the model’s sharply increased ability to find and exploit software vulnerabilities (Z.ai reports 2,436 findings across 269 open-source projects). At the end of August 2026 – on 28 August according to secondary sources – the weights were published on Hugging Face.

Unlike GLM-5, GLM-5.1 and GLM-5.2, they are not under MIT but under the bespoke GLM-5.3 License. The key points per the LICENSE file in the Hugging Face repository:

• Commercial use is permitted, as are modification, fine-tuning and redistribution; the copyright notice and licence text must be included.
• Exception for very large Model-as-a-Service providers: anyone acting as a MaaS provider whose aggregate revenue, including affiliates, exceeds US$10 billion over any consecutive twelve-month period must pass a security review by Z.ai before commercial use. MaaS is defined as giving third parties access to inference or fine-tuning where those users exercise meaningful control over inputs, parameters or training data. End-user products with an embedded model and pure API relay services are explicitly excluded.
• Use must comply with applicable law; warranties are disclaimed. Z.ai takes questions at glmlicense@z.ai.

In practice: for mid-sized users in the DACH region deploying the model internally or in their own products, the revenue threshold is not relevant. But because this is a new licence drafted by the vendor itself, we recommend a brief legal review of the licence text before production use – MIT experience from GLM-5.2 does not carry over one-to-one.

GLM-5.3-Flash – multimodal, lean, MIT

On 26 August 2026, Z.ai released GLM-5.3-Flash. Per docs.z.ai it is the first natively multimodal model of the GLM-5 series and accepts text, image, video and file input. The key specs:

• 320B total parameters, 18B active (Mixture-of-Experts) – per docs.z.ai, attention compute and KV cache drop by a factor of 3.01 and 4.44 respectively versus GLM-5.3
• 1M token context window, up to 128k token output (per docs.z.ai)
• MIT licence per the Hugging Face model card (zai-org/GLM-5.3-Flash) – no revenue thresholds or review obligations
• Reasoning only in enabled mode, controlled via reasoning_effort
• Vendor-reported: Terminal-Bench 2.1 84.3

Independently measured, GLM-5.3-Flash scores 57 points on the Artificial Analysis Intelligence Index v4.1.1 – at around 150M output tokens for the index and a measured output speed of around 45 tokens/s.

Two caveats worth knowing: per the evaluation notes, the benchmarks on the Hugging Face card were run with a maximum context of 300,000 tokens; how the model behaves when the full 1M window is used is therefore not documented. And as with the flagship, reasoning cannot be switched off, which affects latency and token cost.

GLM-5.2 – the last MIT flagship

GLM-5.2 (June 2026) remains available under the MIT licence with no regional usage restrictions. If you need a licence with no special clauses at all for a model of this size class, this is it – at the cost of trailing GLM-5.3:

• Free commercial use without licensing fees
• Modification, fine-tuning and deployment on your own infrastructure
• Full control over data and model, no vendor lock-in

Architecture

744B parameters with 40B active per token in a Mixture-of-Experts architecture. Z.ai highlights IndexShare: one indexer is reused across every four sparse attention layers, cutting per-token compute by 2.9x at a 1M token context. Two reasoning modes are available: High (fast) and Max (deeper for complex coding).

Independent assessment

On the Artificial Analysis Intelligence Index v4.1.1, GLM-5.2 scores 53. Artificial Analysis flags GLM-5.2 as notably token-intensive – around 43,000 output tokens per task versus 26,000 for GLM-5.1. The raw intelligence ranking therefore says little about actual running costs. Anyone buying GLM models through an API should measure consumption against their own workload rather than calculating from the list price. Output speed was measured at around 152 tokens per second.

Pricing

Z.ai API (official price list, USD per 1M tokens)

The price list shows the regular prices; the 50% introductory discount on GLM-5.3-Flash that ran until 9 September 2026 has expired. GLM-5.3-FlashX (18 September 2026) is, per docs.z.ai, the same weights as GLM-5.3-Flash, but an accelerated inference variant delivering up to 200 tokens/s – at a correspondingly higher price and without access via the GLM Coding Plan. The current price list no longer shows GLM-5V-Turbo and GLM-5-Turbo; please verify directly with Z.ai.

Prices per provider, as of October 2026.

GLM Coding Plan

Z.ai also sells coding access as a subscription with a quota system (Lite, Pro, Max plus a Team variant), usable in coding agents such as ZCode, Claude Code, Cline or Roo Code. The entry-level Lite tier is around USD 18 per month; figures for the higher tiers vary by source, which is why we do not quote them here – please check directly with Z.ai. For Coding Plan subscribers, the documentation states that GLM-5.3 is currently reachable only via the OpenAI Chat Completion protocol.

Third-party providers

• OpenRouter carries the GLM family broadly; GLM-5.2 was last listed there at roughly USD 0.49 input and USD 1.54 output per 1M tokens. Whether and on what terms GLM-5.3 and GLM-5.3-Flash are listed there changes quickly – check before deciding.
• Together, Fireworks, DeepInfra and other inference providers carry the open GLM models – predominantly on US infrastructure; older GLM releases are partly available through marketplace catalogues such as NVIDIA NIM.
• AWS Bedrock carries GLM 4.7, GLM 4.7 Flash and GLM 5 (model IDs zai.glm-4.7, zai.glm-4.7-flash, zai.glm-5) with In-Region inference only – including eu-north-1 (Stockholm); eu-west-2 (London) is in the United Kingdom, not the EU. GLM-5.3 (zai.glm-5.3, 744B parameters with about 40B active, 1M context) has been available since 5 October 2026 per the AWS model card, but only via cross-region inference (Geo US us.zai.glm-5.3 and global.zai.glm-5.3), with no In-Region and no EU Geo profile; per AWS, access is limited to eligible customers. For EU data residency, GLM-5.3 on Bedrock is therefore not currently an option.
• Azure AI Foundry lists GLM-5, GLM-5.2 and GLM-5.3 in its model catalogue, but as a Fireworks offering: per Microsoft’s documentation, customer data leaves Microsoft’s systems in this case and is shared with the third party Fireworks AI; Microsoft makes no region guarantee for this offering. Without further review this is not a clean GDPR EU option.
• Google Vertex AI (Gemini Enterprise Agent Platform) offers GLM 4.7, GLM 5 and GLM 5.2 as Model-as-a-Service – per Google’s documentation, exclusively through the “global” endpoint type, i.e. with no EU-specific region.

GDPR assessment

This is a factual assessment, not legal advice. The specific evaluation depends on your deployment scenario and belongs with your data protection function.

Who actually processes the data?

It is important to distinguish two offerings:

• z.ai is the international offering. Per its privacy policy, the operator is JINGSHENG HENGXING TECHNOLOGY PTE. LTD., registered in Singapore. Processing generally takes place out of Singapore. For the API services, Z.ai states that prompts and outputs are not stored but processed in real time.
• open.bigmodel.cn is the Chinese platform of the Zhipu group.

What follows from this

There is no European Commission adequacy decision under Art. 45 GDPR for either China or Singapore. Transferring personal data to these services therefore constitutes a third-country transfer under Art. 44 et seq. GDPR and requires appropriate safeguards under Art. 46 GDPR – in practice standard contractual clauses supplemented by a transfer impact assessment that also evaluates government access possibilities in the destination country. A data processing agreement under Art. 28 GDPR is required in addition.

The commitment not to store API content reduces risk but replaces neither the legal basis for the transfer nor its documentation. For personal or business-critical data we therefore recommend restricting direct API use to non-personal evaluation and prototyping scenarios.

The clean route: EU operation

Because GLM-5.3 (GLM-5.3 License), GLM-5.3-Flash (MIT) as well as GLM-5.2 and GLM-5.1 (MIT) are available as open weights, the third-country question can be solved constructively – the model moves to the data instead of the other way round:

• Self-hosting on your own or rented GPU infrastructure in an EU data centre
• European inference providers: Scaleway has carried GLM-5.2 in its Generative APIs since 26 June 2026 and states that inference runs on European infrastructure with no routing to the model vendor. Nebius also offers GLM models on European infrastructure. Whether GLM-5.3 and GLM-5.3-Flash are already in their catalogues we have not verified. In any case, the data processing agreement, sub-processor list and storage locations should be clarified directly with the provider.
• Private cloud or on-premise for scenarios involving particularly sensitive data

This is exactly the pattern we implement with CompanyGPT: open models in your own EU environment, with access control, logging and tenant separation.

Hardware requirements for self-hosting

Even though only part of the parameters are active per token, with MoE models all expert weights must reside in VRAM. As a rough guide for the weights alone (excluding KV cache):

For the flagships, an 8-GPU H200 node in FP8 is the common reference; GLM-5.3-Flash in FP8 already runs on a 4-GPU node of the H200 class. The KV cache comes on top in each case and is substantial at a 1M token context. vLLM and SGLang are the established serving stacks. If your utilisation is not continuous, a European inference provider is usually more economical than owning hardware.

Superseded models

• GLM-5 (February 2026) and GLM-5.1 (April 2026) have been superseded by GLM-5.2 and GLM-5.3. Both remain available as open weights under MIT and are still in the Z.ai price list.
• GLM-5-Turbo (March 2026) has been overtaken by the 5.1/5.2/5.3 generations.
• Older releases such as GLM-4.5, GLM-4.6 and GLM-4.7 are still offered, partly as free Flash variants, but are no longer the first choice for new projects.
• In third-party catalogues (e.g. NVIDIA NIM), individual GLM releases have already been deprecated. For existing integrations, check your own provider’s announcements, not just Z.ai’s.

Our recommendation

For production use involving personal data, EU self-hosting is the clean route – and there are now three options to choose from:

• GLM-5.3 for maximum performance in coding and agentic contexts: open weights, independently measured (60 points on the Artificial Analysis Intelligence Index), but under the new GLM-5.3 License. For users below the US$10 billion MaaS threshold the licence permits commercial use; the licence text should still be reviewed before rollout.
• GLM-5.3-Flash when multimodality, lower hardware requirements or a licence without special clauses take priority: MIT, 320B parameters with 18B active, 57 points on the Artificial Analysis Intelligence Index.
• GLM-5.2 if you want to keep running an already evaluated MIT flagship and do not want to migrate immediately.

With all three models, measure token consumption against your own workload: the Artificial Analysis measurements show high verbosity for GLM-5.3 and GLM-5.3-Flash, and reasoning cannot be switched off.

We support you with:

• Selecting and evaluating open models for your specific use case
• Infrastructure planning, hardware sizing and cost modelling
• Deployment on EU infrastructure or connection to a European inference provider
• Data protection and AI Act documentation including transfer impact assessment and licence review
• Fine-tuning and integration into existing systems

With a 1M token context window, open weights and strong agentic capabilities, the GLM-5.3 generation offers a solid foundation for sovereign AI applications – provided the infrastructure and licence questions are settled. That is exactly where we help with CompanyGPT.