Company: RAYA
Filing Date: 2025-08-01
Form Type: 424B5
Source: 0001213900-25-070321
Chunk: 157

Company: Erayak Power Solution Group Inc.
Filing Date: 2025-08-01
Form: 424B5
Chunk 157
---
 jointly with the relevant authorities published Measures for Cybersecurity
Review (2021) which took effect on February 15, 2022 and replace the Review Measures, which required that, operators of critical information
infrastructure purchasing network products and services, and data processors (together with the operators of critical information infrastructure,
the “Operators”) carrying out data processing activities that affect or may affect national security, shall conduct a cybersecurity
review, any operator who controls more than one million users’ personal information must go through a cybersecurity review by the
cybersecurity review office if it seeks to be listed in a foreign country.

Under the Data Security Law enacted on September
1, 2021 and the Measures for Cybersecurity Review (2021) implemented on February 15, 2022, since we are not an Operator, nor do we control
more than one million users’ personal information, we would not be required to apply for a cybersecurity review by the CAC. However,
if the CSRC, CAC or other regulatory agencies later promulgate new rules or explanations requiring that we obtain their approvals for
this offering and any follow-on offering, we may be unable to obtain such approvals and we may face sanctions by the CSRC, CAC or other
PRC regulatory agencies for failure to seek their approval which could significantly limit or completely hinder our ability to offer or
continue to offer securities to our investors and the securities currently being offered may substantially decline in value and be worthless.

On August 17, 2021, the State Council promulgated
the Regulations on the Protection of the Security of Critical Information Infrastructure, or the Regulations, which took effect on September
1, 2021. The Regulations supplement and specify the provisions on the security of critical information infrastructure as stated in the
Cybersecurity Review Measures. The Regulations provide, among others, that protection department of certain industry or sector shall notify
the operator of the critical information infrastructure in time after the identification of certain critical information infrastructure.

On August 20, 2021, the Standing Committee of
the NPC approved the Personal Information Protection Law (“PIPL”), which became effective on November 1, 2021. The PIPL regulates
collection of personal identifiable information and seeks to address the issue of algorithmic discrimination. Companies in violation of
the PIPL may be subject to warnings and admonishments, forced corrections, confiscation of corresponding income, suspension of related
services, and fines. We had not collected identifiable or sensitive personal information of