Company: CNEY
Filing Date: 2025-10-29
Form Type: F-1/A
Source: 0001477932-25-007791
Chunk: 35

Company: CN ENERGY GROUP. INC.
Filing Date: 2025-10-29
Form: F-1/A
Chunk 35
---
 time or to exert control over an offering of securities conducted overseas and/or foreign investment in China-based issuers, may cause the operating entities to make material changes to their operation, may limit or completely hinder our ability to offer or continue to offer securities to investors, and/or may cause the value of such securities to significantly decline or be worthless.

Greater oversight by the CAC over data security, particularly for companies seeking to list on a foreign exchange, could adversely impact the operating entities’ business and our offerings.

On December 28, 2021, the CAC, together with 12 other governmental departments of the PRC, jointly promulgated the Cybersecurity Review Measures, which became effective on February 15, 2022. The Cybersecurity Review Measures provides that, in addition to critical information infrastructure operators (“CIIOs”) that intend to purchase Internet products and services, data processing operators engaging in data processing activities that affect or may affect national security must be subject to cybersecurity review by the Cybersecurity Review Office of the PRC. According to the Cybersecurity Review Measures, a cybersecurity review assesses potential national security risks that may be brought about by any procurement, data processing, or overseas listing. The Cybersecurity Review Measures further requires that CIIOs and data processing operators that possess personal data of at least one million users must apply for a review by the Cybersecurity Review Office of the PRC before conducting listings in foreign countries.

On November 14, 2021, the CAC published the Security Administration Draft, which provides that data processing operators engaging in data processing activities that affect or may affect national security must be subject to network data security review by the relevant Cyberspace Administration of the PRC. According to the Security Administration Draft, data processing operators who possess personal data of at least one million users or collect data that affects or may affect national security must be subject to network data security review by the relevant Cyberspace Administration of the PRC.

As of the date of this prospectus, we have not received any notice from any authorities identifying any of the operating entities as a CIIO or requiring any of the operating entities to go through cybersecurity review or network data security review by the CAC. As the Cybersecurity Review Measures became effective and if the Security Administration Draft is enacted as proposed, we believe that the operating entities’ operations and our listing will not be affected and that the operating entities are not subject to cybersecurity review or network data security review by the CAC, given that: (i) as a company that mainly manufactures