Company: XHG
Filing Date: 2025-09-09
Form Type: F-3
Source: 0001213900-25-086186
Chunk: 42

Company: XChange TEC.INC
Filing Date: 2025-09-09
Form: F-3
Chunk 42
---
 the Regulations
on Network Data Security (draft for public comments) and accepted public comments until December 13, 2021. The draft Regulations on Network
Data Security provide more detailed guidance on how to implement the general legal requirements under laws such as the Cybersecurity Law,
Data Security Law and the Personal Information Protection Law. The draft Regulations on Network Data Security follow the principle that
the state will regulate based on a data classification and multi-level protection scheme, under which data is largely classified into
three categories: general data, important data and core data. Under the current PRC cybersecurity laws in China, critical information
infrastructure operators that intend to purchase internet products and services that may affect national security must be subject to the
cybersecurity review. On July 30, 2021, the State Council of the PRC promulgated the Regulations on the Protection of the Security of
Critical Information Infrastructure, which took effect on September 1, 2021. The regulations require, among others, that certain competent
authorities shall identify critical information infrastructures. If any critical information infrastructure is identified, they shall
promptly notify the relevant operators and the Ministry of Public Security.

Currently, the cybersecurity laws and regulations
have not directly affected our business and operations, but in anticipation of the strengthened implementation of cybersecurity laws and
regulations and the expansion of our business, we face potential risks if we are deemed as a critical information infrastructure operator
under the

Cybersecurity Law. In such case, we must fulfill
certain obligations as required under the Cybersecurity Law and other applicable laws, including, among others, storing personal information
and important data collected and produced within the PRC territory during our operations in China, which we are already doing in our business,
and we may be subject to review when purchasing internet products and services. When the amended Measures of Cybersecurity Review take
effect in February 2022, we may be subject to review when conducting data processing activities, and may face challenges in addressing
its requirements and make necessary changes to our internal policies and practices in data processing. As of the date of this prospectus,
we have not been involved in any investigations on cybersecurity review made by the CAC on such basis, and we have not received any inquiry,
notice, warning, or sanctions in such respect. Based on the foregoing, we and our PRC legal counsel, Beijing Kingdom Law Firm, do not
expect that, as of the date of this prospectus, the current applicable PRC laws