Security

Additional Resources

DORA e-Books

English

French

German

Italian

Portuguese

Spanish

DORA Article 30 Amendment

Request Barracuda Essential Suppliers List

Links

DORA Overview

DORA Official Text

Additional Resources

NIS2 e-Books

English

French

German

Italian

Portutuese

Spanish

Links

NIS2 Directive Overview

NIS2 Official Text

What do I need to do to comply?

The most important next step, if you have not already started to prepare for the Act, is to check which risk category your company’s products or services fall under. Most businesses will fall under the limited or minimal risk categories.

Prohibited AI

Prohibition of ‘unacceptable risk’ AI systems took effect on 2 February 2025. Chapter 5 discusses prohibited AI practices.

High risk

Companies that develop and deploy high-risk AI systems need to ensure that their systems are compliant with the requirements set out in Chapter 3, Section 2 of the EU AI Act, titled ‘Requirements for High-Risk AI Systems’. This section of the Act sets out the obligations for businesses that fall in the category, including risk management, record keeping, and maintaining human oversight.

Limited risk

Businesses that develop or deploy limited-risk AI systems are required to provide users with transparency disclosures to ensure that users are aware that they are interacting with or consuming content from an AI system. Article 50 of the AI Act includes more detail on the transparency obligations for these kinds of AI systems.

Minimal risk

Be certain that your AI system falls into the minimal, unregulated category. Keep an eye out for any developments that might affect your business.

If you’re not sure which category your business fall into, you can complete this questionnaire on the official EU AI Act website to find out.

What about Barracuda’s products?

Barracuda Products

Barracuda products and services containing AI fall into the “minimal risk” category. Barracuda includes information regarding the use of AI in the Product and Service Descriptions on the Product Guide.

Find out more about the EU’s AI Act, the risk categories, and what you need to do to comply in our e-book, Getting ready for the EU AI Act.

Additional Resources

AI Act e-Books

English

French

German

Italian

Portuguese

Spanish

Links to AI Act Websites

European Parliament Overview

In-depth Discussion

AI Act Official Text

What is the CLOUD Act?

The purpose of the 2018 U.S. federal CLOUD Act is to help U.S. law enforcement obtain data stored abroad in cross-border investigations involving serious crimes, ranging from terrorism and violent crime to sexual exploitation of children and cybercrime.

Among other things, the CLOUD Act enables the U.S. to enter into reciprocal executive agreements with trusted foreign partners to obtain access to electronic evidence for investigations of serious crimes. These agreements create limited exceptions to U.S. disclosure restrictions so providers can comply with foreign legal orders, subject to strict safeguards. Thus far, the U.S. has only entered into reciprocal agreements with the U.K. and Australia. Negotiations are pending with other jurisdictions.

To whom does the CLOUD Act apply?

The CLOUD Act applies to communication service providers (CSPs), which include cloud service providers. Under the CLOUD Act, the U.S. government may compel CSPs to turn over data if U.S. courts have authority over that company, regardless of where the communications are stored.

This law also extends to companies based outside of the U.S. that have U.S.-based offices or other significant business ties to the U.S. In short, any CSPs with headquarters outside the U.S. and with operations in the U.S. are also subject to the CLOUD Act.

What process must the U.S. government go through before it can get someone’s communications under the CLOUD Act?

The U.S. government may require disclosure of communications through search warrants, subpoenas, or court orders. Whether the U.S. government can obtain communications under the CLOUD Act will depend on several factors, including:

• Warrants issued based on probable cause that the communications are evidence of a crime
• Government to prove that U.S. courts have authority over the CSP
• CSP actually controls the communications at issue

A CSP can ask a court to reject or narrow that demand in certain situations.

What is Barracuda’s process for dealing with CLOUD Act requests?

Barracuda provides Legal Process Guidelines for how the U.S. government can seek access to customer data from Barracuda. As indicate in these Guidelines, and consistent with the CLOUD Act, Barracuda requires that the government present a validly issued court order such as a subpoena to Barracuda before the company will provide any customer data. Unless prohibited by a validly issued Nondisclosure Order, Barracuda will notify the affected customer that it is providing its data to the government.

Certain Barracuda SaaS services, such as Cloud-to-Cloud Backup and Barracuda Cloud Archive Service, allow customers to store back-up copies of data in a cloud environment. Other Barracuda SaaS services may store customer email data for a limited time in connection with providing the service and then delete the data. In the latter instances, Barracuda likely does not have the data that the government seeks. Customers can read more about the data retention process for Barracuda SaaS services on the Product Guide.

Do other countries have anything like the CLOUD Act?

Yes, other countries have laws that require companies to provide data to law enforcement in connection with cross-border investigations involving serious crimes. For example, the United Kingdom’s (U.K.) Crime (Overseas Production Orders) Act allows U.K. law enforcement agencies to obtain stored electronic data located outside of the U.K. in connection with a criminal investigation.