You want AI in your company, but you're not sure how to introduce it safely. Describe a workflow in plain English. Greyrox builds it, runs it, and holds anything sensitive for a person's approval first.
Built for teams of 10–250 people · Available immediately · No engineers required
Gottmer — children's publishing, Netherlands. Editorial and production workflows with approvals and records from the first run, running on a platform Greyrox builds and owns end to end.
Your team gets hours back, clients get faster answers, and you stop falling behind competitors already doing this. Governance is what makes it safe to keep going.
Routine drafting, summarising, and data entry get handled automatically — freeing your team for the work only they can do.
Responses and deliverables move in a fraction of the time, without adding headcount to keep up with demand.
It isn't only the routine tasks getting faster. People are producing work they couldn't a year ago.
AI use is mainstream. Connect the tools your industry is adopting without hiring engineers to wire them together.
These figures reflect broader workplace AI research, not Greyrox's own measured customer results.
AI spend arrives as one line on a card statement, and nobody can say which team spent it. Greyrox prices each workflow as it runs, so you can trace every euro before the bill lands.
Spend broken out per workflow and per run, not aggregated into a single unexplainable total.
Where a task is routine and the risk is low, Greyrox recommends a cheaper model — only if the alternative is still EU-hosted.
A high-risk workflow is never switched to a cheaper model to save money. Cost saving stops where the risk level begins.
Figures shown are illustrative.
Most companies already use AI somewhere: in email, in a browser extension, in a tool a client asked for. The part nobody signed off on is usually small, like a question pasted into a personal ChatGPT tab. Nobody's being reckless. There just isn't an approved place to ask.
Greyrox doesn't claim to see tools you haven't connected to it. What it does is give people an approved place for the one-off question they would otherwise take to a browser tab, with a record of what was asked. How Ask works.
Every workflow, new or already running, goes through the same checks before it's trusted with a live system.
You decide the steps in advance, so Greyrox can classify it from its design.
It works out its own path, so it is approved by what you let it reach.
Pressed with ⌘K, read before it is sent, and kept on the record.
Each workflow is tied to its real EU AI Act risk level and its own open actions, with permissions and an activity log applied as it goes.
Every workflow — your team's idea or ours — goes through the same approval check before it can touch a live system. The checks don't loosen on the tenth workflow because the first nine went fine.
Every workflow request gets checked against your policies before it touches a live system, whether it reads a spreadsheet or sends an email to a client. Actions inside policy run immediately. Anything that reads sensitive data, changes data in a business system such as your CRM or accounting package, or sends something outside the company pauses for a named person to approve — every time, not just the first time.
The agents do the work. Greyrox sits in between — logging what they touched, and holding anything sensitive for a person to approve first.
However many AI tools you connect, they all pass through the same layer — so every action, from any agent, is checked for who is acting and what it may do, and is logged.
An agent cleared to draft emails isn't automatically cleared to send them.
Type what you want in plain English and watch the steps take shape as you refine it. Then send it for approval, or build it step by step yourself if you'd rather.
← swipe to see the full workflow →
Chat-built or hand-built, every draft goes through the approval check. Nothing skips it, not even a cost or convenience fix.
A workflow is a path you decided in advance, so it can be classified from its design. An agent is given a goal and a set of tools and works out its own path. There is no design to read, so it is approved through a mandate instead, a written list of what it may reach, and its risk follows from what you let it reach.
Ask is a single request, checked and recorded, for the question somebody would otherwise paste into a browser tab on an account nobody chose. Press ⌘K from anywhere, type it, and it goes to your workspace's own EU-hosted account.
Two things are tracked separately. The risk level is what the workflow is. It follows from what the workflow touches and barely changes. The open actions are the work still to do, and that number moves as you close things out.
No specific obligations. Logged and access-controlled anyway, because that's how you keep it that way.
Sends content directly to a person outside the company, so the AI Act's transparency rules (Article 50) apply, in force since 2 August 2026. Its send step is held for a person to approve until a named sender is set.
Recruitment screening is explicitly listed as high-risk. The AI Act's high-risk obligations apply from 2 December 2027, deferred from August 2026 by the 2026 amendment. Which obligations land on you depends on whether you built the system or deploy a vendor's.
The AI Act was amended by Regulation (EU) 2026/1744, known as the Digital Omnibus, in force since 27 July 2026.
| What | When it applies |
|---|---|
| Transparency duties (Article 50) | From 2 August 2026 |
| Two new banned practices (Article 5) | From 2 December 2026 |
| High-risk AI in listed areas such as hiring (Annex III) | From 2 December 2027 |
| High-risk AI inside regulated products (Annex I) | From 2 August 2028 |
| AI literacy (Article 4) | Required since February 2025; now a duty to take measures, not to reach a set level |
Much published guidance still cites the old August 2026 deadline for high-risk systems. Which obligations land on you depends on whether you built the system or deploy a vendor's. Greyrox works that out per workflow, so the answer holds up when an auditor asks.
Article 4 asks providers and deployers to take measures to support AI literacy, proportionate to people's roles and the context of use. Greyrox records which measures you took, which course, when, and who recorded it.
It records the measures. Whether they are enough is still your call.
The same workflow usually touches the GDPR, sometimes NIS2 (cybersecurity rules), and, if you employ people, labour law that varies by country. Customers and auditors then ask which standard you can show evidence against. Greyrox has a page for each. Both work the same way: they record what you did and when, they never mark a duty met, and nothing they show is a compliance verdict.
You say which bodies of law you've taken on; the duties follow from that and from what you run. The GDPR, NIS2 (cybersecurity), the Cyber Resilience Act (product security), DORA (financial-sector resilience) and more, plus national rules for the Netherlands, Germany, France, Belgium, Spain and Italy. What doesn't reach you is said, not hidden.
Take on ISO/IEC 42001 (AI management), ISO/IEC 27001 (information security) or SOC 2 and each control names which of your records already covers it, and how far. The assessment you wrote once is not written again.
Each connector follows the same permissions, activity log and risk level, whichever vendor it comes from.
An assistant answers questions. Greyrox sits between your AI tools and your systems: workflows and agents are checked against your policies, sensitive actions wait for a named person to approve them, and every run is on the record. For the one-off question, Ask gives people an approved place to go, on your workspace's own EU-hosted account, read before it is sent.
An automation tool runs what you build. Greyrox also classifies each workflow against the EU AI Act, holds sensitive steps for approval, lets you set company rules that can refuse an action, and gives an agent a mandate instead of a free hand. Every integration follows the same permissions, activity log and risk level.
It starts from the AI that is actually running, not from a checklist. The classification follows from what each workflow touches, and the evidence is the records you already keep, mapped to ISO/IEC 42001, ISO/IEC 27001 and SOC 2 controls. It records what you did and when; it never marks a duty met.
No product can do that for you. Greyrox classifies each workflow, shows what is open, and keeps a record of what you did and when. Whether a duty is met, and how a law applies to your situation, is for you and your legal adviser.
In the EU only. No third party processes the customer data that runs through the platform, it is encrypted in transit and at rest, and it is retained for six months, or deleted sooner on request. The Trust & Security page has the detail.
Greyrox connects to model accounts you already have. Anthropic (with your own Claude API key), AWS Bedrock, and OpenAI or any OpenAI-compatible endpoint, including a self-hosted server, are supported. Azure AI Foundry, Google Vertex AI and Mistral are in alpha. Models are set up per workspace, with the hosting region and retention period of each one shown, and Greyrox recommends a cheaper model for a low-risk task only if it is still EU-hosted.
No. You describe a workflow or a connector in plain English and Greyrox drafts it. Every draft goes through the approval check before it goes live, whether it was chat-built or hand-built.
You record the incident and Greyrox works out the deadlines it creates under the AI Act, the GDPR and NIS2, side by side. It notifies nobody: telling the provider and the authority stays with you.
Greyrox is available immediately. Full onboarding takes days, not weeks: a 30-minute platform demo, connecting your tools in one to two days, governance set up the same week, then guided adoption.
Greyrox is a Dutch company, built and run from Amsterdam, for European companies that want the productivity without the exposure. We build the platform ourselves — our customers run on our own codebase, not on somebody else's engine with our name on it.
Where your data lives, who processes it, and how long we keep it →
Greyrox B.V.
IJsbaanpad 2
1076 CV Amsterdam
The Netherlands
Next to the Olympic Stadium, five minutes' walk from Amsterdam Zuid station.
Open in Maps →Thirty minutes. We'll show you the product on real screens, answer where your data sits, and tell you plainly if we're not the right fit.