FAQ

Grecta is a product compliance platform for digital and AI products sold into the EU. It determines which obligations reach your product across the EU AI Act, GDPR, CRA, DORA, NIS2, MDR and other regimes, then builds the infrastructure around each one: evidence bound to the obligation, recalculation when the law or the product changes, an audit trail of every evaluation, the reports each authority expects, and retention for as long as the obligation runs.

You describe your product in plain English. Grecta extracts what determines applicability (sector, geography, your role in the supply chain, whether personal data is involved, how autonomous the system is) and evaluates that against every framework in the library. You see only the regimes that reach your product, each with a plain-English reason. You do not pick frameworks from a menu.

No. Vanta and Drata govern the organisation: your policies, your access controls, your security posture as a company. Grecta governs the product: what your specific AI system or digital product owes under the law, obligation by obligation. An organisation can hold SOC 2 and ISO 27001 and still have a product that fails an EU AI Act inspection. The two layers solve different problems.

A checklist assumes you already know which rules apply and reduces each one to a tick box. Grecta works at article level. Article 9 of the EU AI Act is not one control, it is nine distinct obligations with different evidence requirements, different determinacy, and different review cycles. Grecta tracks each one separately, with the evidence that closes it and the date it needs revisiting.

No. Grecta provides regulatory analysis and compliance infrastructure. The obligation library is authored by a regulatory lawyer who engaged with the European Commission during the AI Act drafting, and every obligation traces back to the provision that created it so you can verify the reasoning. Where a question turns on legal judgment rather than a clear requirement, Grecta flags it for a human decision instead of answering it for you.

Grecta logs the change and identifies which obligations on which of your products are affected. Those obligations move to a review queue with a plain-English explanation of what moved and what needs revisiting. You are not sent a newsletter and left to work out whether it concerns you.

Yes, and this is where most of the time saving sits. A completed GDPR Article 35 DPIA covers a substantial part of EU AI Act Article 9 risk management. An MDR technical file covers most of EU AI Act Article 11 technical documentation. Grecta maps these overlaps at obligation level and shows you the coverage degree, so you build the document once and it counts everywhere it genuinely applies.

Product and engineering use it to know what a system must satisfy before it ships. Legal and compliance use it to trace every requirement back to the provision behind it. Risk and leadership use it for one live view across every product. Each team works from the same record rather than three disconnected spreadsheets.

Grecta covers over twenty European and international frameworks, including the EU AI Act, GDPR, Cyber Resilience Act, DORA, NIS2, MDR, IVDR, the EU Data Act, the Digital Services Act, ePrivacy, the Revised Product Liability Directive, the EU AI Liability Directive, GPSR, the Radio Equipment Directive, MiFID II, Solvency II, PSD3, AMLD6, the Data Governance Act, ISO 42001, NIST AI RMF, the Colorado AI Act, and the Cambridge HEAT framework.

The library expands continuously toward full coverage of the European digital regulatory stack.

Yes, at article level and in full. Grecta determines your risk tier and your role (provider, deployer, importer, distributor), then maps every obligation that follows: risk management under Article 9, data governance under Article 10, technical documentation under Article 11, transparency under Articles 13 and 50, human oversight under Article 14, quality management under Article 17, conformity assessment, post-market monitoring, and serious incident reporting under Article 73.

No. The moment a product uses AI it typically pulls data protection, cybersecurity, product safety, and sector-specific rules into scope at the same time. Grecta covers that whole surface, because the exposure usually sits in the gaps between regimes rather than inside any one of them.

Yes. Grecta is product compliance infrastructure, and most of the regimes it covers apply to digital products regardless of whether AI is involved. GDPR, the Cyber Resilience Act, the Data Act, GPSR, the Revised Product Liability Directive and NIS2 all reach ordinary software and connected products.

Grecta is European-first by design, with selected international coverage where it matters commercially. NIST AI RMF and the Colorado AI Act are included for companies with US market exposure, and ISO 42001 is covered as the certifiable international standard that EU procurement increasingly asks for. The depth is concentrated on the European stack rather than spread thinly across every jurisdiction.

The obligation library is maintained against the primary legal sources rather than secondary commentary. When an amendment lands, it is assessed against the library and propagated to the products it affects. The Digital Omnibus, which moved the stand-alone Annex III high-risk application date to December 2027, is already reflected throughout.

Your obligations do not stop at your own code. If you integrate a third-party model, a component, or a supplier’s service, their compliance position becomes part of yours. Supply Chain Compliance tracks what you need from each supplier, what they have actually provided, and which of your obligations remain open because a supplier has not closed theirs.

Yes. Frameworks are added based on what customers actually face, and new regimes are evaluated against your existing products automatically once they are in the library. Evidence you have already uploaded is mapped against the new obligations where coverage applies, so adding a regime does not mean starting again.

Grecta is billed annually. Pricing depends on how many products you bring under governance and how many regimes reach them. Most companies start with a paid pilot at a fixed fee of €1,500, which is credited in full against the first year, so the pilot costs nothing if you continue.

No, the paid pilot replaces it. A free trial of compliance software tends to produce an empty account and no decision, because the value only appears once real products and real evidence are in the system. The pilot is scoped, time-boxed and credited against your first year.

Once you complete the free assessment, you can request ECS template packs and the EU Digital Governance Map – these are free to use and require no account. The template packs give you working compliance documents for specific frameworks. The Governance Map shows how the European digital regulatory stack fits together and which regimes typically reach which kinds of product.

You bring real products under governance against the regimes that actually reach them, upload your existing evidence, and see where it already closes obligations and where gaps remain. You finish the pilot with a working compliance record rather than a report, and the fee is credited in full if you continue.

All evidence and compliance records are stored in EU infrastructure. Each organisation’s data is isolated at database level, and every document is versioned with a full record of who uploaded it, who verified it, and which obligations it was mapped to at each point in time.

Bringing a first product under governance takes minutes rather than weeks, because the intake is a plain-language description rather than a questionnaire. Mapping your existing evidence against the obligations it already closes typically takes a few hours. Accounts activate within 24 hours of signup.

No, and the product is built on the assumption that you do not have one. The intake requires no legal knowledge, every obligation is written in plain English with the provision behind it available if you want it, and remediation guidance says what to produce and what it must contain. Companies with compliance teams get more out of it, but they are not the requirement.

Consultants produce an assessment at a point in time. The assessment ages the moment your product ships a new version or the law moves. Grecta holds the live record between engagements, which usually makes consultant time cheaper and more focused, because they start from a current picture instead of rebuilding one. Several consultancies run their client work on Grecta directly.