ECARX Holdings (ECX) Risk Factors

Our product and service offerings involve the collection, storage, and transmission of data and we face significant challenges with respect to cybersecurity, privacy, data protection, and information security amid a complex and evolving regulatory framework in China and other geographies that we operate in. Information stored on our systems may be targeted in cyber-attacks, including computer viruses, worms, phishing attacks, malicious software programs, and other information security breaches, which could result in the unauthorized release, gathering, monitoring, misuse, loss, or destruction of such information. If cybercriminals are able to circumvent our security measures, or if we are unable to detect and prevent an intrusion into our systems, data stored with us may be compromised and susceptible to unauthorized access, use, disclosure, disruption, modification, or destruction, which could subject us to liabilities, fines, and other penalties. Additionally, if any of our employees accesses, converts, or misuses any sensitive information, we could be liable for damages, and our business reputation could be damaged or destroyed. Any actual or perceived breach of our security could damage our reputation, cause existing customers to discontinue the use of our products and services, prevent us from attracting new customers, or subject us to third-party lawsuits, regulatory fines, or other actions or liabilities, any of which could materially and adversely affect our business, financial condition, and results of operations. We have adopted strict information security policies and deployed advanced security measures to comply with applicable requirements and to prevent data loss and other security breaches, including, among others, advanced encryption technologies. Nonetheless, these measures could be breached as a result of third-party action, employee error, third-party or employee malfeasance, or otherwise. Because the techniques used to obtain unauthorized access or to sabotage systems change frequently, we may not be able to anticipate these techniques and implement adequate preventative or protective measures. We are subject to a multitude of laws and regulations that aim to address information security, privacy, and the collection, storage, sharing, use, disclosure, and protection of data in various jurisdictions. Specifically, our operations in China are subject to a variety of PRC laws and regulations covering cybersecurity, privacy, data protection, and information security, including, among others, the PRC National Security Law, the PRC Cyber Security Law, the PRC Personal Information Protection Law, the PRC Data Security Law, the Regulations on Security Protection of Critical Information Infrastructure, the revised Measures for Cybersecurity Review, the Several Provisions on Automobile Data Security Management (for Trial Implementation), the Administrative Measures for Data Security in the Field of Industry and Information Technology (for Trial Implementation), the Measures for Security Assessment of Cross-Border Data Transfers. Such PRC laws and regulations were promulgated by PRC government authorities in recent years and impose higher compliance requirements on internet service providers and other network operators, such as in respect of the purposes, methods and scope of information collection and the use of information, acquisition of appropriate user consent, establishment of user information protection systems, and protection of national security. In practice, the PRC government authorities have heightened their supervision on the protection of data security by initiating investigations on certain mainland China companies regarding their cybersecurity and use of personal information and data. Given the novelty of these laws and regulations, there are substantial uncertainties with respect to their interpretation and implementation and additional laws and regulations on this subject may be promulgated in the future, which may impose further requirements on us. We cannot assure you that we will or will continue to be in compliance with all regulatory requirements that will be imposed on us, and we may be faced with additional compliance costs, increased obligations, and potential liability and negative publicity for non-compliance. On July 30, 2021, the State Council promulgated the Regulations on Security Protection of Critical Information Infrastructure, which took effect on September 1, 2021. It clarifies that, among others, the competent government authorities of certain important industries are authorized to make rules for and administer the identification of critical information infrastructure and promptly notify the critical information infrastructure operators and the public security authorities of the State Council of the results thereof. On December 28, 2021, the CAC and certain other PRC government authorities promulgated the revised Measures for Cybersecurity Review, or the Revised Measures for Cybersecurity Review, which came into effective on February 15, 2022 and replaced the Measures for Cybersecurity Review promulgated in April 2020. Pursuant to the Revised Measures for Cybersecurity Review, in addition to critical information infrastructure operators purchasing network products or services that affect or may affect national security, any online platform operator conducting data processing activities that affect or may affect national security should also be subject to a cybersecurity review. The Office of Cybersecurity Review may initiate a cybersecurity review at its own discretion pursuant to applicable procedures in accordance with the Revised Measures for Cybersecurity Review. The PRC government authorities may further enact detailed rules or issue guidance with respect to the interpretation and implementation of these rules and regulations, including rules on the identification of critical information infrastructure and the exact definition of "online platform operator." As such, it remains uncertain whether we or other operators we provide network products and services to may be identified as critical information infrastructure operators or online platform operators. If we provide or are deemed to be providing network products and services to critical information infrastructure operators, or if we are deemed to be a critical information infrastructure operator, we would be required to follow applicable cybersecurity review procedures, and additional obligations may also be imposed on us with respect to the protection of critical information infrastructure according to the Cyber Security Law. If we are identified as an online platform operator and our data processing activities are considered to be affecting or may affect national security, we might be subject to a cybersecurity review. Because the Revised Measures for Cybersecurity Review do not define "online platform operator" or clarify the meaning of "affect or may affect national security," and given the PRC government authority's discretion to initiate a cybersecurity review, it is possible that we would be subject to an ex officio cybersecurity review. Such review, if undertaken, could result in certain disruptions to our operations, negative publicity with respect to us and diversion of our managerial and financial resources. Failure to complete the cybersecurity review could result in penalties such as fines, suspension of business, shutdown of websites, and revocation of business licenses and permits, any of which could materially and adversely affect our business, financial condition, and results of operations. For a comprehensive discussion on the aforementioned laws and regulations, see "Item 4. Information on the Company-B. Business Overview-Regulations-Regulation on Cyber Security and Privacy Protection." In response to the tightening of regulatory framework in China governing data security, cybersecurity, and privacy, in September 2021 we initiated an internal process to transfer the rights of our mainland China subsidiaries and Hubei ECARX to access and process personal data relevant to their respective business operations to Zhejiang Huanfu Technology Co., Ltd., or Zhejiang Huanfu. The transfer was completed in December 2021 and as of the date of this annual report, our mainland Chin subsidiaries do not have any right to access or process any personal data other than certain employee personal data and certain vehicle identification numbers provided by automotive OEMs in association with our provision of maintenance and repair services. In January 2022, we entered into a procurement framework agreement with Zhejiang Huanfu and concluded several procurement-related contracts pursuant to the procurement framework agreement for the sole purpose of contracting Zhejiang Huanfu to discharge our outstanding obligations to provide certain data-related services to our PRC customers. As of the date of this annual report, we have not been informed that we are a critical information infrastructure operator or a data processor conducting data processing activities that affect or may affect national security by any government authority, but it is uncertain whether we would be categorized as such under the PRC law. As of the date of this annual report, we have not been involved in any investigations or cybersecurity review by the CAC and we have not received any official inquiry, notice, warning, or sanctions in this respect. We cannot rule out the possibility that the foregoing measures may be enacted, interpreted, or implemented in ways that will adversely affect us. We cannot assure you that we would be able to accomplish any review (including the cybersecurity review), obtain any approval, complete any procedures, or comply with any other requirements applicable to us in a timely manner, or at all, if we are subject to the same. In the event of non-compliance, we may be subject to government investigations and enforcement actions, fines, penalties, and suspension of our noncompliant operations, among other sanctions, which could materially and adversely affect our business, financial condition, and results of operations. We expect that PRC operations in the areas referenced above will receive greater public scrutiny and attention from regulators and more frequent and rigid investigation or review by regulators, which will increase our compliance costs and subject us to heightened risks. We are closely monitoring the development in the regulatory landscape and we are constantly in the process of evaluating the potential impact of the Cyber Security Law, the Civil Code, the Data Security Law, the Personal Information Protection Law, and other applicable laws and regulations on our current business practices. It remains uncertain whether any future regulatory changes would impose additional restrictions on companies like us. If further changes to our business practices are required under the evolving regulatory framework governing cybersecurity, information security, privacy, and data protection in China, our business, financial condition, and results of operations may be materially and adversely affected. Aside from our operations in China, we are also required to comply with increasingly complex and rigorous regulatory standards enacted to protect business and personal data in the United States, Europe, and elsewhere. For example, the European Union adopted the General Data Protection Regulation, or the GDPR, which took effect on May 25, 2018. The GDPR imposes additional obligations on companies regarding the handling of personal data and provides certain individual privacy rights to persons whose data is stored. We generally comply with industry standards and are subject to the terms of our own privacy policies. We have incurred, and will continue to incur, significant expenses in an effort to comply with privacy, data protection, and information security standards and protocols imposed by laws, regulations, industry standards, or contractual obligations. Changes in existing laws or regulations or adoption of new laws and regulations relating to privacy, data protection, and information security, particularly any new or amended laws or regulations that require enhanced protection for certain types of data or new obligations with regard to data retention, transmission, or disclosure, could greatly increase our cost in providing our service offerings, require significant changes to our operations, or even prevent us from offering certain services in jurisdictions in which we currently operate or in which we may operate in the future. Compliance with these laws and regulations could cause us to incur substantial costs, and may place restrictions on the conduct of our business and the manner in which we interact with our customers or require us to change our business practices, including our data practices, in a manner adverse to our business. Despite our efforts to comply with applicable laws, regulations, and other obligations relating to cybersecurity, privacy, data protection, and information security, it is possible that our practices, offerings, services, or platform could fail to meet all of the requirements imposed on us by such laws, regulations, or obligations. We cannot assure you that we are or will be able to comply with such laws and regulations regarding cybersecurity, privacy, data protection, and information security in all respects and any failure or perceived failure to comply with the same may result in inquiries or other proceedings being instituted against, or other actions, decisions, or sanctions being imposed on us by government authorities, consumers, or other parties, including warnings, fines, penalties, directions for rectifications, service suspension, or removal of our application from application stores, as well as in negative publicity on us and damage to our reputation, any of which could cause us to lose customers and business partners and materially and adversely affect our business, financial condition, and results of operations.

We face an inherent business risk of exposure to warranty claims and product liability in the event that our products fail to perform as expected and, in the case of product liability, such failure of our products results in bodily injury or property damage. The fabrication process of our products is complex and precise. Our customers specify quality, performance, and reliability standards. If flaws in either the design or manufacture of our products were to occur, we could experience a rate of failure in our products that could result in significant delays in delivery and product re-work or replacement costs. Although we engage in extensive product quality programs and processes, these may not be sufficient to avoid product failures, which could cause us to: - lose revenue;- incur increased costs such as warranty expense and costs associated with customer support;- experience delays, cancellations, or rescheduling of orders for our products;- experience increased product returns or discounts; or - damage our reputation. All of these could adversely affect our financial condition and results of operations. If any of our products are or are alleged to be defective, we may be required to participate in a recall involving such products. A recall claim brought against us, or a product liability claim brought against us in excess of our available insurance, may have a material adverse effect on our business.

We conduct our business worldwide and we have offices in various countries. One of our key business strategies is to pursue international expansion of our business operations and market our products in multiple jurisdictions. We have established our international operations office in London and research and development and deployment capabilities in North America, Europe, and Southeast Asia. As a result, our business is and we expect that our business will continue to be subject to a variety of risks associated with doing business internationally, including an increase in our expenses and diversion of management's attention from other aspects of our business. Accordingly, our business and financial results in the future could be adversely affected due to a variety of factors, including: - international economic and political conditions, and other political tensions between countries in which we do business;- unexpected changes in, or impositions of, legislative or regulatory requirements, including changes in tax, data security, and privacy laws;- differing legal standards with respect to protection of intellectual property and employment practices;- local business and cultural factors that differ from our normal standards and practices, including business practices that we are prohibited from engaging in by the Foreign Corrupt Practices Act and other anti-corruption laws and regulations;- export or import controls and restrictions, including deemed export restrictions, tariffs, quotas and other trade barriers and restrictions; and - disruptions of capital and trading markets and currency fluctuations; and increased costs due to imposition of climate change regulations, such as carbon taxes, fuel or energy taxes, and pollution limits. In addition, we may be subject to increased regulatory risks and local competition in various jurisdictions where we plan to expand operations but has limited operating experience. Such increased regulatory burden and competition may limit the available market for our products and services and increase the costs associated with marketing the products and services where we are able to offer our products. If we are unable to manage the complexity of global operations successfully, or fail to comply with any of the regulations in other jurisdictions, our financial performance and operating results could suffer.

Global pandemics, epidemics in China or elsewhere in the world, or fear of spread of contagious diseases, such as Ebola virus disease, Middle East respiratory syndrome, severe acute respiratory syndrome, H1N1 flu, H7N9 flu, and avian flu, as well as hurricanes, earthquakes, tsunamis, or other natural disasters could disrupt our business operations, reduce or restrict our supply of materials and services, incur significant costs to protect our employees and facilities, or result in regional or global economic distress, which may materially and adversely affect our business, financial condition, and results of operations. Actual or threatened war, terrorist activities, political unrest, civil strife, and other geopolitical uncertainty could have a similar adverse effect on our business, financial condition, and results of operations. Any one or more of these events may impede our production and delivery efforts and adversely affect our sales results, or even for a prolonged period of time, which could materially and adversely affect our business, financial condition, and results of operations. We are also vulnerable to natural disasters and other calamities. Although we have servers that are hosted in an offsite location, our backup system does not capture data on a real-time basis and we may be unable to recover certain data in the event of a server failure. We cannot assure you that any backup systems will be adequate to protect us from the effects of fire, floods, typhoons, earthquakes, power loss, telecommunications failures, break-ins, war, riots, terrorist attacks, or similar events. Any of the foregoing events may give rise to interruptions, damage to our property, delays in production, breakdowns, system failures, technology platform failures, or internet failures, which could cause the loss or corruption of data or malfunctions of software or hardware as well as adversely affect our business, financial condition, and results of operations.

The automotive intelligence market is highly competitive. We have strategically entered into this market and we expect this segment to become more competitive in the future as more players make their entrance. Competition is based primarily on technology, innovation, quality, delivery, and price. Many of our current and potential competitors, particularly international competitors, have significantly greater financial, technical, manufacturing, marketing, and other resources than we do and may be able to devote greater resources to the design, development, manufacturing, distribution, promotion, sale, and support of their products. We cannot assure you that our products and services will be able to compete successfully with those of our existing and any new competitors. If we fail to compete successfully, our prospects, results of operations, and financial condition could be adversely affected. We expect competition to intensify in the future in light of the increased demand for automotive intelligence technologies, the continuing globalization, and the consolidation in the automotive industry worldwide. Our future success will depend on our ability to develop superior advanced technology and to maintain our competitive position with respect to our technological advances over our competitors. Furthermore, the rapidly evolving nature of the markets in which we compete has attracted, and may continue to attract, new entrants, particularly in areas of evolving automotive technologies such as computing platform technologies and advanced driver-assistance systems, which have attracted new entrants from outside the traditional automotive industry, and any of these competitors may develop and introduce technologies that gain greater customer or consumer acceptance, which could adversely affect our future growth. In addition, increased competition may lead to lower unit sales and increased inventory, which may in turn result in downward price pressure and adversely affect our business, financial condition, operating results, and prospects. Therefore, the ability to stay ahead of our competitors will be fundamental to our future success. Our competitors may foresee the course of market development more accurately than us, develop products and services that are superior to ours, have the ability to produce similar products at a lower cost than us, adapt more quickly than us to new technologies or evolving customer requirements, or develop or introduce new products or solutions before we do, particularly related to potential transformative technologies such as automotive central computing platform solutions and advanced driver-assistance systems. As a result, our products and services may not be able to compete successfully with those of our competitors. These trends may adversely affect our sales as well as the profit margins on our offerings. If we do not continue to innovate to develop or acquire new and compelling products that capitalize upon new technologies, this could have a material adverse impact on our results of operations.

Our business and prospects are affected by our ability to develop, maintain, and strengthen our brand. If we fail to do so we may lose the opportunity to build business relationships with critical customers. Promoting and positioning our brand will depend significantly on our ability to provide innovative and high-quality products and services, in which we have limited experience. In addition, we expect that our ability to develop, maintain, and strengthen the brand will depend heavily on the success of our branding efforts. We market our brand through media, word-of-mouth, trade shows, and advertising. Such efforts may not achieve the desired results. If we do not develop and maintain a strong brand, our business, financial condition, results of operations, and prospects will be materially and adversely affected. Our reputation and brand are vulnerable to many threats that can be difficult or impossible to predict, control, and costly or impossible to remediate. From time to time, our products and our business operations in general are reviewed by media or other third parties. Any negative reviews or reviews that compare us unfavorably to competitors could adversely affect public perception about our products. Negative publicity about us, such as alleged misconduct, unethical business practices or other improper activities, or rumors relating to our business, directors, officers, employees, shareholders, affiliates or actual or potential business partners can harm our reputation, business, and results of operations, even if they are baseless or satisfactorily addressed. These allegations, even if unproven or meritless, may lead to inquiries, investigations, or other legal actions against us by regulatory or government authorities as well as private parties. Any regulatory inquiries or investigations and lawsuits against us, perceptions of inappropriate business conduct by us, or perceived wrongdoings by any member of our management team, among other things, could substantially damage our reputation, and cause us to incur significant costs to defend ourselves. Any negative market perception or publicity regarding our suppliers or other business partners that we closely cooperate with or may cooperate with, or any regulatory inquiries or investigations and lawsuits initiated against them, may also have an adverse effect on our brand and reputation, or subject us to regulatory inquiries or investigations or lawsuits. Moreover, any negative media publicity about the automotive intelligence technologies, especially the autonomous driving technologies, or product or service quality problems of other players in the industry in which we operate, including our competitors, may also adversely affect our reputation and brand. In particular, given the popularity of social media, including Weixin and Weibo in China, any negative publicity, whether true or not, could quickly proliferate and harm customer and user perceptions and confidence in our brand. If we are unable to maintain a good reputation or further enhance our brand recognition, our ability to attract and retain customers, third-party partners, and key employees could be harmed and, as a result, our business, financial condition, and results of operations could be materially and adversely affected.