You want AI in your company, but you're not sure how to introduce it safely. Greyrox lets you build AI workflows by describing them in plain English, with approval checks built in, so nothing sensitive happens without a person signing off. No technical knowledge needed.
Built for teams of 10–250 · Available immediately · No engineers required
Gottmer — children's publishing, Netherlands. Editorial and production workflows governed from the first run, delivered on our own platform, with no third-party engine underneath.
Your team gets hours back, clients get faster answers, and you stop falling behind competitors already doing this. Governance is what makes it safe to keep going — but it isn't why you start.
Routine drafting, summarising, and data entry get handled automatically — freeing your team for the work only they can do.
Responses and deliverables move in a fraction of the time, without adding headcount to keep up with demand.
The same quality bar on the first task of the day and the fiftieth — less depends on who's busy or who's tired.
Connect the AI tools already changing your industry, without hiring engineers to wire them together yourself.
These figures reflect broader workplace AI research, not Greyrox's own measured customer results.
AI spend arrives as one line on a card statement, and nobody can say which team spent it. Greyrox prices each workflow as it runs, so the bill is attributable before it lands.
Spend broken out per workflow and per run, not aggregated into a single unexplainable total.
Where a task is templated and the risk is low, Greyrox recommends a cheaper model — only if the alternative is still EU-hosted.
A high-risk workflow is never switched to a cheaper model to save money. Cost optimisation stops where the risk tier begins.
Figures shown are illustrative.
Most companies are already using AI somewhere — in email, in a browser extension, in a tool a client asked for. The part nobody signed off on is usually small and human: a question pasted into a personal ChatGPT tab, a free trial that quietly became a daily habit. Nobody's being reckless. It's just what happens when there's no governed place to ask.
Greyrox doesn't claim to see tools you haven't connected to it. What it does is give people a governed place for the one-off question they would otherwise take to a browser tab — and a record of what was asked there. How Ask works.
Staff reach for a browser tab because it's fast. Without a governed alternative there's no record of what was asked, on which account, or what it carried.
One tool flags data leaks, another checks model bias, a third does access logs. None of them talk to each other.
Most AI governance advice is written for enterprises with dedicated compliance staff. You have neither the time nor the headcount.
The point isn't a bigger inventory — it's a safe way to add the next workflow. Every one, new or already running, goes through the same checks before it's trusted with a live system.
Each workflow is tied to its real EU AI Act tier and its own open actions, with permissions and an audit trail applied as it goes.
Every workflow — your team's idea or ours — goes through the same policy check before it can touch a live system. Approved actions run, anything sensitive pauses for a person, and the guardrails don't loosen on the tenth workflow just because the first nine went fine.
Every workflow request gets checked against your policies before it touches a live system, whether it reads a spreadsheet or sends an email to a client. Actions inside policy run immediately. Anything that reads sensitive data, writes to a system of record, or sends something outside the company pauses for a named person to approve — every time, not just the first time.
The agents do the work. Greyrox sits in between — logging what they touched, and holding anything sensitive for a person to approve first.
However many AI tools you connect, they all pass through the same layer — so every action, from any agent, gets the same identity check, permission, and log entry.
An agent cleared to draft emails isn't automatically cleared to send them.
No canvas required to start. Type what you want in plain English and watch the steps take shape as you refine it — then send it for review, or hand-build it yourself node by node if you'd rather.
← swipe to see the full workflow →
Every draft — chat-built or hand-built — goes through policy review before it goes live. A cost or convenience fix can never quietly skip that step.
A workflow is a path you decided in advance, so it can be classified from its design. An agent is given a goal and a toolbox and works out its own path. There is no design to read, so it is approved as a mandate instead, and its risk follows from what you let it reach.
Ask is one request, governed. Not a workflow and not an agent: the question somebody would otherwise paste into a browser tab on an account nobody chose. Press ⌘K from anywhere, type it, and it goes to your workspace's own EU-hosted account.
The tier is what the workflow is: it follows from what the workflow touches and it barely changes. The open actions are the work state — that's the number that moves as you close things out. Greyrox keeps them apart, and keeps them attached to the workflow all the way into production.
No specific obligations. Logged and permissioned anyway, because that's how you keep it that way.
Sends content directly to a person outside the company, so the Article 50 transparency obligations apply — in force since 2 August 2026. Its send step is held for a person to approve until a named sender is set.
Recruitment screening is explicitly listed as high-risk. Chapter III obligations apply from 2 December 2027, deferred from August 2026 by that summer's Omnibus amendment. Which obligations land on you depends on whether you built the system or deploy a vendor's.
The AI Act's Digital Omnibus amendment — Regulation (EU) 2026/1744 — entered into force on 27 July 2026. It pushed high-risk obligations under Annex III to 2 December 2027 and Annex I to 2 August 2028, while Article 50 transparency still applies from 2 August 2026. Article 4 has required AI literacy since February 2025, and the Omnibus turned it into a duty to take measures rather than to guarantee a level. Article 5 gained two new prohibitions from 2 December 2026. A great deal of published guidance — and a great many vendor decks — still cite the old August 2026 deadline.
Which obligations land on you depends on whether you built the system or deploy a vendor's. Greyrox works that out per workflow, so you're not guessing, and so the answer survives being asked by an auditor.
Article 4 asks providers and deployers to take measures to support AI literacy, proportionate to people's roles and the context of use. Greyrox records which measures you took, which course, when, and who recorded it.
It records the measures. Whether they are enough is still your call.
The same workflow usually touches the GDPR, sometimes NIS2, and, if you employ people, labour law that varies by country. Customers and auditors then ask which standard you can show evidence against. Greyrox has a page for each. Both work the same way: they record what you did and when, they never mark a duty met, and nothing they show is a compliance verdict.
You say which bodies of law you've taken on; the duties follow from that and from what you run. The GDPR, NIS2, the Cyber Resilience Act, DORA and more, plus national rules for the Netherlands, Germany, France, Belgium, Spain and Italy. What doesn't reach you is said, not hidden.
Take on ISO/IEC 42001, ISO/IEC 27001 or SOC 2 and each control names which of your records already covers it, and how far. The assessment you wrote once is not written again.
Every integration inherits the same permissioning, audit log and risk status — no matter which vendor it comes from.
An assistant answers questions. Greyrox sits between your AI tools and your systems: workflows and agents are checked against your policies, sensitive actions wait for a named person to approve them, and every run is on the record. For the one-off question, Ask gives people a governed place to go, on your workspace's own EU-hosted account, read before it is sent.
An automation tool runs what you build. Greyrox also classifies each workflow against the EU AI Act, holds sensitive steps for approval, lets you set company rules that can refuse an action, and gives an agent a mandate instead of a free hand. Every integration inherits the same permissions, audit log and risk status.
It starts from the AI that is actually running, not from a checklist. The classification follows from what each workflow touches, and the evidence is the records you already keep, mapped to ISO/IEC 42001, ISO/IEC 27001 and SOC 2 controls. It records what you did and when; it never marks a duty met.
No product can do that for you. Greyrox classifies each workflow, shows what is open, and keeps a record of what you did and when. Whether a duty is met, and how a law applies to your situation, is for you and your legal adviser.
In the EU only. No third party processes the customer data that runs through the platform, it is encrypted in transit and at rest, and it is retained for six months, or deleted sooner on request. The Trust & Security page has the detail.
Greyrox connects to model accounts you already have. Anthropic (with your own Claude API key), AWS Bedrock, and OpenAI or any OpenAI-compatible endpoint, including a self-hosted server, are supported. Azure AI Foundry, Google Vertex AI and Mistral are in alpha. Models are set up per workspace, with the hosting region and retention of each one shown, and Greyrox recommends a cheaper model for a low-risk task only if it is still EU-hosted.
No. You describe a workflow or a connector in plain English and Greyrox drafts it. Every draft goes through policy review before it goes live, whether it was chat-built or hand-built.
You record the incident and Greyrox works out the deadlines it creates under the AI Act, the GDPR and NIS2, side by side. It notifies nobody: telling the provider and the authority stays with you.
Greyrox is available immediately. Full onboarding takes days, not weeks: a 30-minute platform demo, connecting your tools in one to two days, governance set up the same week, then guided adoption.
Greyrox is a Dutch company, built and run from Amsterdam, for European companies that want the productivity without the exposure. We build the platform ourselves — our customers run on our own codebase, not on somebody else's engine with our name on it.
Where your data lives, who processes it, and how long we keep it →
Greyrox B.V.
IJsbaanpad 2
1076 CV Amsterdam
The Netherlands
Next to the Olympic Stadium, five minutes' walk from Amsterdam Zuid station.
Open in Maps →Thirty minutes. We'll show you the handoff on real screens, answer where your data sits, and tell you plainly if we're not the right fit.