Company: SOS
Filing Date: 2025-07-02
Form Type: S-8
Source: 0001213900-25-061032
Chunk: 37

Company: SOS Ltd
Filing Date: 2025-07-02
Form: S-8
Chunk 37
---
the ADSs have been listed on Nasdaq Capital Market since November 2018. Considering the substantial uncertainties existing with respect
to the enactment timetable, final content, interpretation and implementation of the Draft Measures for Internet Data Security, in particular
with respect to the explanation or interpretation for “affects or may affect national security,” there remain uncertainties
as to whether our data processing activities may be deemed to affect national security, thus subjecting us to a cybersecurity review.
As of the date of this prospectus, we have not received any formal notice from any cybersecurity regulator that we shall be subject to
a cybersecurity review.

On December 28, 2021,
the CAC and 12 other government authorities published the Measures for Cybersecurity Review, which took effect on February 15, 2022. The
Measures for Cybersecurity Review provides that certain operators of critical information infrastructure purchasing internet products
and services or network platform operators carrying out data processing activities, which affect or may affect national security, must
apply with the Cybersecurity Review Office for a cybersecurity review. On July 30, 2021, the State Council promulgated the Regulations
on Protection of Critical Information Infrastructure, which became effective on September 1, 2021. Pursuant to the Regulations on Protection
of Critical Information Infrastructure, critical information infrastructure shall mean any important network facilities or information
systems of an important industry or field, such as public communication and information service, energy, communications, water conservation,
finance, public services, e-government affairs and national defense science, and any other important network facilities or information
system which may endanger national security, people’s livelihoods and public interest in the event of damage, function loss or data
leakage. In addition, relevant administrative departments of each critical industry and sector, shall be responsible to formulate eligibility
criteria and determine the critical information infrastructure operator in the respective industry or sector. The operators shall be informed
about the final determination as to whether they are categorized as critical information infrastructure operators. As of the date of this
prospectus, the exact scope of “critical information infrastructure operators” under the current regulatory regime remains
unclear, and we have not been informed that we are identified as a critical information infrastructure operator by any governmental authorities.
Furthermore, since the Measures for Cybersecurity Review is relatively new and the determination of “affecting national security”
are subject to further explanations and interpretations, there remain uncertainties as to whether our data processing activities may be
deemed to affect national security and