--- title: "AI Governance Certification: AIGP, AAISM, AAIA or ISO 42001?" url: "https://certmadeeasy.com/blog/ai-governance-certification/" description: "AIGP, AAISM, AAIA, AAIR or ISO 42001? Compare IAPP, ISACA and PECB AI governance certifications by cost, prerequisites and who each one is for." date: "2026-10-06" author: "Cert Made Easy" --- # AI Governance Certification: AIGP, AAISM, AAIA or ISO 42001? Most people choosing an AI governance certification have fewer options than they think. ISACA's three AI certifications (AAISM, AAIA and AAIR) only take candidates who already hold a qualifying credential such as CISM, CISSP or CISA. If you don't hold one, your choice is between IAPP's [AIGP](https://certmadeeasy.com/blog/aigp-study-guide/), which has no prerequisites, and an ISO/IEC 42001 exam such as [PECB's Lead Auditor](https://certmadeeasy.com/catalog/set-pecb-iso-42001-la), which you can sit without any training or experience. If you do hold one, pick by the work you do: [AAISM](https://certmadeeasy.com/catalog/set-isaca-aaism) if you manage security, [AAIA](https://certmadeeasy.com/catalog/set-isaca-aaia) if you audit, [AAIR](https://certmadeeasy.com/catalog/set-isaca-aair) if you manage risk. Still deciding whether an AI certification is worth it at all? Start with [what the hiring data says](https://certmadeeasy.com/blog/are-ai-certifications-worth-it/). ## The five AI governance certifications side by side | Certification | Issuer | Who can sit it | Exam fee | Exam | Pass mark | |---|---|---|---|---|---| | AIGP (Artificial Intelligence Governance Professional) | IAPP | Anyone | $799, or $649 for IAPP members | 100 questions, 165 minutes | 300 on a 100 to 500 scale | | AAISM (Advanced in AI Security Management) | ISACA | Active CISM or CISSP holders | $599, or $459 for ISACA members | 90 questions, 150 minutes | 450 on a 200 to 800 scale | | AAIA (Advanced in AI Audit) | ISACA | CISA holders, or listed audit and accounting designations | $599, or $459 for ISACA members | 90 questions, 150 minutes | 450 on a 200 to 800 scale | | AAIR (Advanced in AI Risk) | ISACA | Holders of a listed risk, audit or security credential | $599, or $459 for ISACA members | 90 questions, 150 minutes | 450 on a 200 to 800 scale | | ISO/IEC 42001 Lead Auditor | PECB | Anyone | $1,000 on its own, included with PECB training | 80 questions, 3 hours, open book | 70% | Fees are in US dollars and cover the exam only. ISACA adds a one-time $50 application fee after you pass, and PECB charges $500 to apply for the certificate. ## Can you take AAISM, AAIA or AAIR without CISA or CISM? No. Each of ISACA's AI certifications requires an existing credential: - **AAISM:** "AAISM candidates must hold an active CISM or CISSP certification," in ISACA's words. - **AAIA:** an active CISA, or a designation such as CIA, US CPA or ACCA held alongside an IT audit or IT advisory role. - **AAIR:** one of ISACA's CISA, CISM, CRISC, CGEIT or CDPSE, or an outside credential such as CISSP, CIA, CGRC or PMI-RMP. ISACA's lists differ slightly between its pages and candidate guides, so check before you register. All three are on our [ISACA page](https://certmadeeasy.com/catalog/isaca). If none of these is on your CV, it's AIGP or ISO 42001 for now. ## Is AIGP the right AI governance certification if you come from privacy? Often, yes. Without an ISACA or ISC2 credential, it's one of only two options on this list. Your privacy background carries over to a lot of it. One of the four domains is about how laws, standards and frameworks apply to AI: existing privacy law, intellectual property, nondiscrimination, consumer protection, and AI-specific laws such as the EU AI Act. It even covers ISO 42001 as one of the standards. The new material is elsewhere: two of the four domains are about governing how AI is built and how it's deployed: impact assessments, training data, testing, monitoring and incident management. The exam is 100 questions in 165 minutes, at a Pearson VUE center or online through OnVUE. Certification lasts two years from the day after you pass. Our [AIGP study guide](https://certmadeeasy.com/blog/aigp-study-guide/) covers the Body of Knowledge in detail, and the [AIGP practice exam guide](https://certmadeeasy.com/blog/aigp-practice-exam/) shows how to find the domains that are new to you. If you'd rather start with privacy itself, IAPP's privacy certifications have their own guides: [CIPP/E](https://certmadeeasy.com/blog/cipp-e-study-guide/), [CIPM](https://certmadeeasy.com/blog/cipm-study-guide/) and [CIPT](https://certmadeeasy.com/blog/cipt-study-guide/) guides. ## What's the difference between AAISM, AAIA and AAIR? All three share the same format, pass mark and fee. What differs is the job each one is for, and the domain weights show it. **AAISM** is for people who run security. It splits into AI Governance and Program Management (31%), AI Risk and Opportunity Management (31%) and AI Technologies and Controls (38%). ISACA calls it "the first and only AI-centric security management certification." If you searched for an AI security certification, this is the one. [AAISM practice questions](https://certmadeeasy.com/catalog/set-isaca-aaism) **AAIA** is for auditors. Nearly half of it (46%) is AI Operations: data management, change management, testing and incident response for AI systems. The rest is AI Governance and Risk (33%) and AI Auditing Tools and Techniques (21%). [AAIA practice questions](https://certmadeeasy.com/catalog/set-isaca-aaia) **AAIR** is the newest, launched in April 2026, and it's for risk professionals. The largest domain is AI Risk Program Management (42%), followed by AI Risk Governance and Framework Integration (37%) and AI Life Cycle Risk Management (21%). [AAIR practice questions](https://certmadeeasy.com/catalog/set-isaca-aair) The simple version: AAISM builds and runs the controls, AAIA checks them, and AAIR decides which risks matter and what to do about them. ## Is ISO 42001 a certification for people or for companies? Both. A company has its AI management system certified against ISO/IEC 42001 through an audit. A person takes an exam about the standard, such as PECB's ISO/IEC 42001 Lead Auditor. The Lead Auditor exam is mostly about auditing. Of its 80 questions, 20 cover the AI management system itself and 60 cover audit principles and preparing, running, closing and managing audits. It's open book: you can bring a hard copy of the standard, the course materials and your own course notes. You need 70% to pass. There's no prerequisite to sit it, but the title you get depends on your experience. With none, you're a Provisional Auditor. The full Lead Auditor title needs five years of professional experience, two of them in AI management, plus 300 hours of AI management system audits. The certificate lasts three years. It suits auditors, compliance managers and consultants, and anyone whose company is heading for ISO/IEC 42001 certification. PECB's other management system exams are on our [PECB page](https://certmadeeasy.com/catalog/pecb). [ISO/IEC 42001 Lead Auditor practice questions](https://certmadeeasy.com/catalog/set-pecb-iso-42001-la) ## Which AI governance certification fits your job? | If your week is mostly... | Look at | |---|---| | Privacy, legal, policy or compliance work | AIGP | | Running security, and you hold CISM or CISSP | AAISM | | Auditing IT, and you hold CISA or a listed accounting designation | AAIA | | Managing IT or enterprise risk, and you hold a listed credential | AAIR | | Auditing management systems, or helping your company get ISO/IEC 42001 certified | ISO/IEC 42001 Lead Auditor | If two rows fit, try five questions for each (links in the next section). ## Try five questions before you book These exams cost $459 to $1,000, a lot to spend on a guess. Before you register, answer five exam-style questions for the one you're leaning toward. No account needed. - [AIGP](https://certmadeeasy.com/catalog/set-iapp-aigp): privacy, legal, policy and compliance - [AAISM](https://certmadeeasy.com/catalog/set-isaca-aaism): security managers with CISM or CISSP - [AAIA](https://certmadeeasy.com/catalog/set-isaca-aaia): IT auditors with CISA or a listed designation - [AAIR](https://certmadeeasy.com/catalog/set-isaca-aair): risk professionals with a listed credential - [ISO/IEC 42001 Lead Auditor](https://certmadeeasy.com/catalog/set-pecb-iso-42001-la): auditors and anyone preparing a company for ISO/IEC 42001 If the questions read like your job, book that exam. If most feel foreign, try the next one before you pay for anything. ## Frequently asked questions ### Which AI governance certification is best? None is best for everyone. Without CISA, CISM, CISSP or similar, choose between AIGP and ISO/IEC 42001 Lead Auditor. With one, pick the ISACA certification that matches your work: security, audit or risk. ### How much do AI governance certifications cost? The exam fees run from $459 (an ISACA AI exam at the member price) to $1,000 (PECB's standalone Lead Auditor exam). AIGP is $799, or $649 for IAPP members. Each one also has renewal costs, which differ by issuer. ### Can I get more than one AI governance certification? Yes, they test different material. A CISA holder could take AAIA for audit work and AIGP for the legal and policy side. Start with the one your job uses most.