Company: LI
Filing Date: 2025-04-10
Form Type: 20-F
Source: 0001410578-25-000678
Chunk: 160

Company: Li Auto Inc.
Filing Date: 2025-04-10
Form: 20-F
Item: Item 4
Chunk 160
---
2021, the Standing Committee of the National People’s Congress promulgated the PRC Data Security Law, which took effect in September 2021. The Data Security Law introduces a data classification and hierarchical protection system based on the materiality of data in economic and social development, as well as the degree of harm it will cause to national security, public interests, or legitimate rights and interests of persons or entities when such data is tampered with, destroyed, divulged, or illegally acquired or used. It also provides for a security review procedure for the data activities which may affect national security.

91

On August 17, 2021, the State Council issued the Regulations on Protection of Security of Critical Information Infrastructure, which took effect on September 1, 2021, pursuant to which “critical information infrastructures” refers to critical network facilities and information systems involved in important industries and sectors, such as public communication and information services, energy, transportation, water conservancy, finance, public services, governmental digital services, science and technology related to national defense industry, and those that may seriously endanger national security, national economy, and citizen’s livelihood or public interests if damaged or malfunctioned, or if any leakage of data in relation thereto occurs. Pursuant to these regulations, the governmental authorities are responsible for stipulating rules for the identification of critical information infrastructures with reference to several factors set forth in the regulations, and further identify the critical information infrastructure operators in the related industries in accordance with such rules. The authorities should also notify operators identified as the critical information infrastructure operators.
On July 30, 2021, the MIIT released the Opinions on Strengthening the Management of Intelligent Network Automotive Manufacturers and Product Access, pursuant to which intelligent automotive manufacturers are required to strengthen the management of automobile data security, network security, online software upgrade, functional safety, ensure product quality and production consistency, and promote high-quality development of the intelligent internet connection automobile industry. The opinions require intelligent automotive manufacturers to store personal information and important data in China, and security assessment needs to be made in case of cross-border transfer of personal data and important data. It also requires intelligent automotive manufacturers to establish data asset management accounts, implement data classification and hierarchical management, strengthen the protection of personal information and important data, take technical measures for data security protection to ensure that data is continuously in a state of effective protection and legal use, and implement data security risk assessment, data security incident reporting, and other requirements in accordance with the law.
On August 16,