EU Cyber Resilience Act
The EU Cyber Resilience Act (CRA) is a product-focused regulation that was adopted in December 2024 and will apply to new products with digital elements placed on the EU market after 10 December 2027 and to existing products with digital elements that are substantially modified after that date. The CRA is a broad-reaching regulation that not only addresses the obligations of product “manufacturers” (highlighted in the Barracuda e-Book below), but also establishes obligations of importers and distributors. Companies that manufacture, import, or distribute products with digital elements into the EU should immediately begin the process to understand how the CRA affects their business and undertake the necessary measures to be ready.
Barracuda status information below is as of 11 September 2026. Barracuda will provide updates as further status information is available.
- Classifying Products: We have classified our covered products into “default,” “Important Class I,” and “Important Class II”. Barracuda does not offer any products that would be classified as “Critical.” Below is a chart showing the Barracuda products subject to the CRA and their classification.
| Default | Important Class I | Important Class II |
|---|---|---|
|
Email Threat Sanner
|
Load Balancer (physical / virtual appliance)
|
Web Application Firewall (WAF) (physical / virtual appliance)
|
|
Barracuda Message Archiver
|
SecureEdge (physical / virtual appliance)
|
|
|
Email Security Gateway (physical / virtual appliance)
|
CloudGen Firewall (physical / virtual appliance)
|
|
|
Barracuda Backup Server (physical / virtual appliance)
|
Web Security Gateway (physical / virtual appliance)
|
- Conformity Assessments: We have begun creating the documentation to self-certify the “default” products. Barracuda is waiting for regulators to identify entities authorized to conduct third party conformity assessments for the “Important” products.
- Documentation: We are also assembling the End User Information described in Annex II and will also be creating the technical documentation under Annex VII to be available for regulators, if needed.
- Security Reporting: Barracuda is registered and ready to comply with the security vulnerability and incident reporting requirements that started September 11, 2026.
Additional Resources
CRA e-Books
Links to CRA Websites
Don’t wait to get protected
Get a free consultation with a cybersecurity expert and see Barracuda's cybersecurity solutions in action.
