Company: LI
Filing Date: 2025-04-10
Form Type: 20-F
Source: 0001410578-25-000678
Chunk: 51

Company: Li Auto Inc.
Filing Date: 2025-04-10
Form: 20-F
Item: Item 3
Chunk 51
---
 security review procedure for the data activities that may affect national security.
On December 28, 2021, the CAC, the National Development and Reform Commission, or the NDRC, the Ministry of Industry and Information Technology, or the MIIT, and several other PRC government authorities jointly issued the Cybersecurity Review Measures, which took effect on February 15, 2022 and further restates and expands the applicable scope of the cybersecurity review in effect. Pursuant to the Cybersecurity Review Measures, critical information infrastructure operators that procure internet products and services and network platform operators engaging in data processing activities must be subject to the cybersecurity review if their activities affect or may affect national security. The Cybersecurity Review Measures further stipulate that network platform operators holding personal information of over one million users must apply to the Cybersecurity Review Office for a cybersecurity review before public offering on a foreign stock exchange. Although our securities have been listed on the Nasdaq Global Select Market and the Hong Kong Stock Exchange, given the Cybersecurity Review Measures was relatively new, there are uncertainties as to the interpretation, application, and enforcement of the Cybersecurity Review Measures. On August 17, 2021, the State Council promulgated the Regulations on Protection of Critical Information Infrastructure, which took effect on September 1, 2021 and defines critical information infrastructure as any important network facilities or information systems of important industry or field such as public communication and information service, energy, communications, water conservation, finance, public services, e-government affairs, and national defense science, which may endanger national security, people’s livelihood, and public interest in case of damage, function loss, or data leakage. In addition, according to the Regulations on Protection of Critical Information Infrastructure, the administration departments for each critical industry and sector should be responsible to formulate eligibility criteria and determine the scope of critical information infrastructure operator in the respective industry or sector. The operators will be informed about the final determination as to whether they are categorized as critical information infrastructure operators. As of the date of this annual report, no detailed implementation rules have been issued by any government authorities and we have not been informed as a critical information infrastructure operator by any government authorities. Furthermore, the exact scope of “critical information infrastructure operators” under the current regulatory regime remains unclear, and the PRC government authorities may have discretion in the interpretation and enforcement of these laws. Therefore, it is uncertain whether we would be deemed as a critical information infrastructure operator under PRC law. If so, we will be subject to more scrutiny from the government authorities