AI governance roles are being filled faster than shared standards of competence exist, and many AIGP candidates prepare from material written for a body of knowledge that has since been replaced. This guide sets out what the IAPP itself publishes about the Artificial Intelligence Governance Professional (AIGP) credential: the four domains of body of knowledge version 2.1, the 100-question exam, fees, the two-year maintenance cycle and the rules that lead to suspension. It adds a phased preparation plan and career context. It is written for privacy, security, risk and engineering practitioners deciding whether the AIGP fits their path. All IAPP facts were checked on IAPP pages in October 2026.
Key takeaways
- The blueprint changed in 2026. Body of knowledge version 2.1 took effect on 2 February 2026, superseding version 2.0.1, and organises the exam into four domains; older material describing a different structure is out of date.
- It is a governance exam, not a machine learning exam. Two of the four domains cover governing AI development and governing AI deployment and use, and a full domain covers how privacy law, other law, AI-specific law and standards apply.
- There is no experience gate. IAPP's AIGP handbook page lists no prerequisites, so the exam and the maintenance rules are the only requirements.
- The exam is short on time per question. 100 multiple-choice questions in 2.75 hours plus a 15-minute break, with a passing scaled score of 300 on a 100 to 500 scale.
- Maintenance is a two-year cycle. Holders need 20 CPE credits per term and either IAPP membership or a USD 250 certification maintenance fee; missing either suspends the credential.
Who the certification is for
The IAPP describes the AIGP as showing competence in AI development, ethical deployment and AI management practice, and aims it at professionals in all industries who need to understand and carry out responsible AI governance. The IAPP is a not-for-profit, policy-neutral association founded in 2000, best known for privacy credentials such as the CIPP and CIPM.
- Good fit: privacy professionals extending into AI, risk and compliance staff who run AI risk assessments or AI registers, product counsel, and security leads asked to stand up an AI governance committee. See the AI Governance Guide for the programme these roles deliver.
- Good fit for technical staff moving into oversight: data scientists and ML engineers who need the legal and policy vocabulary to work with a governance function.
- Weaker fit: practitioners whose job is testing or securing models and agents at a technical level. A security-focused AI credential may match better; see the ISACA AAISM and AAIA AI Certifications Guide.
- Auditors and implementers of a management system: if the job is to build or audit an AI management system against ISO/IEC 42001, see the ISO 42001 Lead Auditor and Lead Implementer Guide.
Accreditation: IAPP's candidate handbook (version 5.3.2) states that the AIGP is not accredited by ANAB, while CIPP/E, CIPP/US, CIPM and CIPT are accredited under ISO/IEC 17024:2012. The AIGP follows the same policies and procedures. This matters only where an employer or contract specifically requires an ISO/IEC 17024 accredited credential.
Exam format and domains
Format
| Item | What the IAPP publishes | Source |
|---|---|---|
| Questions | 100 multiple-choice questions | IAPP store, AIGP exam |
| Scored and unscored | 85 scored, 15 unscored; unscored items do not count | IAPP AIGP candidate handbook page |
| Time | 2.75 hours plus an optional 15-minute break | IAPP store, AIGP exam |
| Break rule | The break splits the exam into two timed halves; the first half must be submitted before the break and cannot be revisited | IAPP candidate handbook v5.3.2 |
| Question style | One correct answer and three plausible distractors; about 30% of questions are tied to case studies; no penalty for wrong answers | IAPP AIGP candidate handbook page |
| Passing standard | Scaled score of 300 on a 100 to 500 scale | IAPP candidate handbook v5.3.2 |
| Delivery | Pearson VUE test centres or OnVUE live remote proctoring; book at least 24 hours ahead | IAPP candidate handbook v5.3.2 |
| Language | English is the only language listed on the exam store page | IAPP store, AIGP exam |
| Results | Pass or fail, scaled score and a percentage breakdown by body of knowledge section | IAPP AIGP candidate handbook page |
The break rule has a practical consequence: flag doubtful items in the first half and resolve them before the break, because you cannot go back. With 100 questions in 165 minutes, you have under 100 seconds per question, and case study items take longer to read. The AIGP handbook page was written for an earlier body of knowledge, so confirm the scored and unscored split on IAPP's current pages before exam day.
The four domains (body of knowledge version 2.1)
The IAPP does not publish percentage weights. Instead, the blueprint gives a minimum and maximum number of questions per domain and per competency, shown below.
| Domain | Competencies | Questions (min to max) |
|---|---|---|
| I. Understanding the foundations of AI governance | I.A What AI is and why it needs governance; I.B Establish and communicate organisational expectations; I.C Policies and procedures across the AI life cycle | 16 to 20 |
| II. Understanding how laws, standards and frameworks apply to AI | II.A Existing data privacy laws; II.B Other existing laws; II.C AI-specific laws; II.D Industry standards and tools | 19 to 23 |
| III. Understanding how to govern AI development | III.A Designing and building the system; III.B Data collection and use in training and testing; III.C Release, monitoring and maintenance | 21 to 25 |
| IV. Understanding how to govern AI deployment and use | IV.A Factors and risks in the decision to deploy; IV.B Assessing the system; IV.C Governing deployment and use | 21 to 25 |
Domains III and IV together carry roughly half the scored questions, and competency IV.C (governing deployment and use) has the largest single range. Domain II names specific instruments: the EU AI Act, the South Korean AI Basic Law, US federal and state AI laws for the private sector, the OECD principles for trustworthy AI, the NIST AI Risk Management Framework and Playbook, and ISO/IEC 22989, 42001 and 42005. The blueprint also states that question complexity follows Bloom's Taxonomy, so expect application and analysis items, not just recall.
Where to see the domains in practice
This column is our revision suggestion, not IAPP content.
| Domain | NHI Mgmt Group guides that cover the working reality |
|---|---|
| I | AI Governance Guide, AI Register and AI Inventory Template |
| II | EU AI Act Compliance Guide, NIST AI RMF Guide, ISO/IEC 42001 Guide, AI and Privacy Guide |
| III | AI Model Risk Management Guide, AI Risk Assessment Guide |
| IV | AI Impact Assessment Template, Third-Party AI Risk Guide, Shadow AI Discovery Guide |
Where identity fits: the blueprint does not name identity, but governing deployment in practice means knowing which AI systems and agents run with which credentials and permissions. An AI inventory without the service accounts, API keys and tokens each system uses is incomplete. See the AI Governance Guide for how ownership and access tie into the register.
Prerequisites and experience
IAPP's AIGP candidate handbook page lists no prerequisites: there is no minimum work experience, endorsement or prior IAPP credential. The general handbook states only that certification depends on meeting all applicable requirements, which in practice are passing the exam, agreeing to the Certificant Code of Professional Conduct and keeping the credential active.
The absence of an experience gate cuts both ways. Anyone can sit the exam, but case study questions assume you can apply a law or framework to a scenario, which is much easier for candidates who have sat in on a real AI risk review or impact assessment. If you have none, run one as a study exercise using the AI Impact Assessment Template before booking.
Preparation plan
The IAPP publishes the body of knowledge and exam blueprint free, offers a study guide with sample questions through a request form, and sells training in four formats: self-paced online, live online, in-person and group training. The six training modules are foundations of AI, AI impacts and responsible principles, AI governance and risk management, laws and standards, governing AI development and governing AI deployment. The store lists the online training at USD 1,195 and a digital practice exam at USD 60. The plan below works with or without paid training.
- Download the current blueprint (week 0): confirm it says version 2.1, effective 2 February 2026. Discard any resource that maps to a different domain structure.
- Baseline (week 1): score yourself against each competency (I.A to IV.C) on a simple 1 to 3 scale. Privacy specialists usually start strong in II.A and weak in III; engineers the reverse.
- Read the primary instruments (weeks 2 to 4): study the EU AI Act risk tiers and obligations, the NIST AI RMF functions and Playbook, and the scope of ISO/IEC 42001 and 42005 from the publishers' own pages, not summaries. See the EU AI Act High-Risk AI Systems Guide for the provisions most often examined in scenarios.
- Work the life cycle (weeks 5 to 7): for domains III and IV, write one page per competency on what the governance function does at that stage: who approves, what evidence is kept and what triggers a re-assessment.
- Practise case studies (weeks 8 to 9): about 30% of items are case-based, so practise reading a scenario once, noting the organisation's role (developer or deployer) and jurisdiction, and answering several questions from it.
- Timed rehearsal (week 10): sit a full 100-question mock in 165 minutes, split into two halves with no return to the first half.
- Book and sit: schedule within one year of purchase, at least 24 hours ahead. If you fail, a retake can be booked no sooner than seven days after the attempt.
Small vs large organisations: a candidate in a small company may be the whole AI governance function, so the exam's committee and policy material should be adapted rather than copied. In a large organisation, use the exam domains to agree a shared vocabulary between legal, privacy, security and data science, and consider a cohort with a fixed exam date.
Measuring readiness
- Competency coverage: no competency scored 1 on your self-assessment by week 8.
- Mock performance: two timed mocks completed in 165 minutes at a comfortable margin above your target.
- Case study accuracy: case-based items answered at the same rate as standalone items.
- Primary source reading: each instrument named in domain II read at least once from the official text.
Cost, renewal and continuing education
| Item | Amount or rule (as published by the IAPP, checked October 2026) |
|---|---|
| Exam fee | USD 649 for IAPP members; USD 799 for non-members |
| Retake fee | USD 475 members; USD 625 non-members (AIGP handbook page); also applies to holders of another IAPP credential |
| Exam window | Schedule and sit within one year of purchase; expired fees are forfeited |
| Retake wait | No sooner than seven days after the prior attempt, once the result shows in MyIAPP |
| Annual professional membership | USD 295 (store listing) |
| Certification maintenance fee (CMF) | USD 250 per two-year term, or covered by active membership; non-members receive a complimentary CMF with the exam purchase |
| CPE | 20 credits per certification per two-year term, or retest |
| Carry over | Up to 10 surplus credits per certification, only if earned in the final six months of the term |
| If CPE is missed | Suspension; the shortfall is added to the next term (8 missed means 28 needed) |
| If still suspended at term end, or CMF or membership unpaid | Revocation; the exam must be retaken |
| Audits | Monthly CPE audits; evidence due within 30 days of a request |
The authority is IAPP's CPE policy (version 3.3.1, effective 7 April 2026) and candidate handbook (version 5.3.2, effective 1 June 2026). CPE credits count across all IAPP credentials held, so a CIPP or CIPM holder adding the AIGP mid-term should read the policy's rules on when the new credential's first 20 credits fall due.
Common failure patterns
- Studying an old blueprint: courses and question banks built before version 2.1 use a different domain structure; check every resource against the four domains above.
- Reading laws through summaries: domain II questions turn on who the obligation falls on and when; second-hand summaries often blur developer and deployer duties.
- Mispacing the first half: spending too long on early case studies and then submitting the first half with unanswered items that cannot be revisited.
- Letting membership lapse: holders who rely on membership to cover the CMF are suspended when the membership is not renewed, even if CPE is complete.
- Logging CPE late: surplus credits only carry over if earned in the last six months, and monthly audits ask for evidence within 30 days.
- Treating it as technical assurance: the credential tests governance judgement; it does not show that the holder can test model security or agent permissions.
Where it fits on the career path
- From privacy: CIPP or CIPM holders add the AIGP to extend into AI governance, and CPE credits count across credentials. See the CIPP/E and CIPP/US Certification Guide and CIPM and CIPT Certification Guide.
- From security and risk: the AIGP adds the legal and policy layer; pair it with security depth from the ISACA AAISM and AAIA AI Certifications Guide or management system skills from the ISO 42001 Lead Auditor and Lead Implementer Guide.
- Towards engineering roles: practitioners heading into hands-on AI security should see the AI Security Engineer Career Guide.
- Comparing options: the Cybersecurity Certifications Guide places the AIGP among other governance and security credentials.
The IAPP pages checked publish no pass rates or salary figures for the AIGP, and we do not quote third-party estimates.
Practitioner checklist
- Download the body of knowledge and confirm it is version 2.1, effective 2 February 2026.
- Self-assess against all 13 competencies and plan study by the blueprint's question ranges.
- Read the EU AI Act, NIST AI RMF and ISO/IEC 42001 scope from primary sources.
- Decide between membership (covers the CMF) and paying the USD 250 CMF per term.
- Sit at least one full 100-question mock in 165 minutes with a locked first half.
- Book within the one-year window and at least 24 hours ahead, at a test centre or via OnVUE.
- Diarise the two-year term end and log CPE credits as you earn them.
- Keep CPE evidence ready for a monthly audit request with a 30-day deadline.
Standards and references
- IAPP: Artificial Intelligence Governance Professional (AIGP)
- IAPP: AIGP Body of Knowledge and Exam Blueprint
- IAPP: AIGP Candidate Handbook
- IAPP: Candidate Handbook
- IAPP: AIGP Exam
- IAPP: Continuing Professional Education Policy
- IAPP: Certification Maintenance Fee
- IAPP: AIGP Training
Related NHI Mgmt Group resources: AI Governance Guide · Cybersecurity Certifications Guide · ISACA AAISM and AAIA AI Certifications Guide · EU AI Act Compliance Guide · NIST AI RMF Guide