Frequently asked questions about AI governance and Fruggr
Find answers to the most frequently asked questions about Fruggr: AI governance, registry and shadow AI, ROI, compliance, data security and implementation.
Understanding Fruggr and AI governance
The basics, the intended audience and the typical journey
What is AI governance in a company?
It is the set of rules, roles and tools that make it possible to know which AI is used, by whom and for what, and to control its costs, risks and compliance. It answers three questions: what are we deploying, who is responsible for it, and what does each use deliver.
What is Fruggr and who is the platform for?
Fruggr is a SaaS platform that brings together, in a single cockpit, visibility into AI usage (including shadow AI), ROI management by initiative and regulatory compliance. It is intended for CIOs, Chief AI Officers, compliance, legal and data protection teams, CISOs, procurement and executive leadership.
How does the AI Governance module work?
The module is organized around three areas: Govern (policy, roles, governance maturity, transparency, training), Map & Measure (registry, risk, maturity, cost, impact, ROI, usage) and Manage (action plan and audit log). The typical journey takes six steps:
- create an AI system in the registry;
- qualify its risk level;
- assess its maturity;
- declare its data sources to obtain cost and impact;
- track obligations and actions;
- formalize the policy and the transparency statement at the organization level.
Registry, usage and shadow AI
Seeing and measuring what is actually used
What is the AI systems registry?
It is the single inventory of the organization’s AI systems, whether internal, SaaS or open source. Each record carries the system, its progress, its tags, the people concerned and its owner. It can be filtered and searched, every change is traced in an audit log, and a check flags use cases that are already declared to avoid duplicates.
How does Fruggr detect shadow AI?
Fruggr relies on two channels to spot undeclared usage:
- Infrastructure: the platform detects resources that consume GPU. If they are not linked to any declared system, they are flagged as potential shadow AI.
- Browser extension: available with the AI Governance offer, it reports workstation activity to identify unauthorized or unlisted AI tools. A filter avoids counting the same usage twice.
The results appear in the AI Usage screen.
How does Fruggr measure actual AI usage?
Four channels are possible:
- Cloud billing: provider APIs (AWS, Azure, Google Cloud…), filtered by tags to isolate the impact of the AI system alone.
- Observability: OpenTelemetry (OTLP) telemetry for token-level measurement (input, output, cache) and prompt counts.
- Hybrid mode: a combination of the first two channels.
- Browser extension: usage on the workstation.
Cost, token usage, environmental impact (CO2e, water, hardware) and detected shadow AI are shown in the AI Usage screen and in the registry.
Which AI tools can be connected to Fruggr?
Tools such as Claude Code, Claude Cowork, OpenAI Codex or GitHub Copilot can send their telemetry to Fruggr, either directly to Fruggr Telemetry or through your own observability platform (for example Datadog or Grafana Cloud). Fruggr also connects to the billing APIs of the main cloud providers.
How is consumption linked to an AI system?
Telemetry data arrives in bulk. An administrator creates assignment rules that say which lines belong to which system, based on criteria such as the model, the team or the project. Without a rule, telemetry is received but no system shows measured usage. A coverage screen shows what is assigned, overlapping, unassigned or tied to a disabled rule.
ROI and financial management
Linking each AI use to its cost and value
How does Fruggr calculate the ROI of an AI system?
The calculator compares total cost of ownership with benefits weighted by adoption and risk factors.
- Costs: initial investment (CAPEX) and recurring annual costs (OPEX: cloud, licenses, LLM inference, maintenance, monitoring, support).
- Benefits: four families (productivity, quality, lead time, additional revenue).
- Weighting: adoption maturity, integration into processes and risk (default settings: 55%, 70% and 20%).
Five indicators result: ROI as a percentage, payback period, annualized cost, weighted benefits and net gain. A 1 to 10-year projection (3 years by default) goes with them.
Where do the amounts come from, and can they be trusted?
OPEX items (cloud hosting, SaaS subscriptions, API access) can be pre-filled from the system’s data sources, with the source and the date of the reading. Users can enter their own value, and the automatic amount stays visible. Each item can carry an assumption note and a source. Months with no data are never extrapolated: they are flagged as incomplete. Benefits remain estimates entered by the organization.
Compliance and maturity
Regulations, frameworks and system assessment
How does Fruggr qualify the risk level of a system?
A guided questionnaire of 5 to 10 minutes offers 16 questions across four sections (qualification, scope and exclusions, role and context, risk classification). It is adaptive: at most 13 questions per journey. The result is one of eight levels under the EU AI Act: prohibited practice, high risk, high risk + transparency, GPAI, transparency + GPAI, transparency, minimal risk or out of scope. Completed assessments are kept in a history. The result supports the analysis but does not replace legal advice.
What happens once the risk is qualified?
The applicable legal obligations are listed in a compliance report that leads to the tracking of remediation actions and the action plan. As long as a system has not been assessed, it appears as “Not assessed”, not as low risk.
How is the maturity of a system assessed?
A 16-question questionnaire covers six areas: Climate & Financial, Accountability, Ethics & Fairness, Reliability, Transparency & Explainability, Security & Privacy. Each question is scored from 1 to 5, with an overall score out of 5 and a level (immature, emerging, operational, advanced, leader). The assessment is collaborative and traced in the audit log.
How does Fruggr help set up the organization’s governance framework?
The module offers a guided questionnaire to generate the AI policy (or the import of an existing policy with a critical review), an AI transparency statement, a roles and responsibilities matrix and a training catalog.
What is the difference between NIST AI RMF, ISO/IEC 42001 and the EU AI Act, and what does each commit you to?
- NIST AI RMF: a voluntary risk management framework of U.S. origin, organized around four functions (govern, map, measure, manage). It is neither mandatory nor certifiable, and serves as a good-practice reference.
- ISO/IEC 42001: a voluntary AI management system standard. It commits you to put in place and maintain a structured framework (policies, roles, risk analysis, continuous improvement). It can be certified by an accredited body, with regular audits.
- EU AI Act: a mandatory European regulation. It applies according to the company’s role (provider, deployer…) and the risk level of its systems. It commits you to respect the prohibitions and, depending on risk, documentation, transparency, human oversight and monitoring obligations, under penalty of sanctions.
The three complement each other: the EU AI Act sets the legal minimum, the other two help structure and prove the approach. Fruggr handles them in a single cockpit.
Does Fruggr make it possible to obtain ISO/IEC 42001 certification?
No. Certification is issued by an accredited body. Fruggr helps prepare the process by structuring the registry, responsibilities, assessments and evidence.
Security, data and access
Hosting, personal data, roles and AI assistants
Where is the data hosted and how is it protected?
Data is hosted in France, backups included. It is encrypted at rest with AES-256, and internal flows are protected by TLS 1.2 or 1.3. Access secrets for third-party providers are kept in a dedicated Azure Key Vault. Single sign-on (SSO) is possible with SAML 2.0. A regular vulnerability detection process is applied, and the Security Assurance Plan is available on request from Customer Support.
What personal data can telemetry contain, and what does Fruggr keep?
Telemetry can carry, without you intending it, a system account name, an email address or a user identifier. No identifying value is kept in clear: Fruggr keeps a one-way fingerprint, salted per organization, which makes it possible to match two occurrences of the same person without reconstructing the original value. Identifying keys cannot be used as a criterion in assignment rules. The raw archive of received payloads is kept for 180 days, and the identity fingerprint for as long as the usage event that carries it.
How long is data kept?
User accounts and entered data, including the registry, are kept for the duration of the contract. Data collected through external provider APIs (cloud, usage) is kept for 12 rolling months at most. At the end of the contract, all data is destroyed after a few weeks, leaving time for reversibility.
Does Fruggr use AI, and where does my data go?
The AI assistant in the AI Governance module helps draft and review the policy, and only the text of imported policies is sent to it. The chosen provider is Mistral AI, with processing in Europe and a Zero Data Retention policy enabled by default. Interactions may also be used to improve Fruggr’s AI. This setting is enabled by default, can be changed at any time by an administrator, and can be disabled without contacting Customer Support.
Who can do what in the platform?
Each person is an administrator or a member, per organization. Members have access to most of the module: registry, assessments, policy, action plan and audit log. Observability tools and assignment rules are reserved for administrators, including when an AI assistant acts on behalf of the user.
Can Fruggr be queried from an AI assistant?
Yes, through an MCP server. The assistant answers from the organization’s governance data, with the user’s rights. Administrators choose whether to open read-only or contribution access. Claude, Claude Code, ChatGPT, OpenAI Codex and VS Code with GitHub Copilot have been tested by the Fruggr team, and other assistants (Microsoft 365 Copilot, Perplexity, Cursor…) are recognized as compatible.
Getting started with Fruggr
Budget, timelines and support
How much does Fruggr cost and how quickly can we start?
Fruggr starts at €15,000 per year, depending on scope and the modules chosen. A project can be launched in a few days: declaring the first systems, connecting a collector, assignment rules and the first assessments.
What support and complementary tools does Fruggr offer?
A team of experts supports clients according to their needs, from onboarding to structuring governance. The training catalog is built into the module, and a generative AI greenhouse gas emissions simulator, based on the TokenFlop method, remains available. It gives orders of magnitude.