AI Governance Certification: AIGP, AAISM, AAIA or ISO 42001?

Most people choosing an AI governance certification have fewer options than they think. ISACA's three AI certifications (AAISM, AAIA and AAIR) only take candidates who already hold a qualifying credential such as CISM, CISSP or CISA. If you don't hold one, your choice is between IAPP's AIGP, which has no prerequisites, and an ISO/IEC 42001 exam such as PECB's Lead Auditor, which you can sit without any training or experience.

If you do hold one, pick by the work you do: AAISM if you manage security, AAIA if you audit, AAIR if you manage risk. Still deciding whether an AI certification is worth it at all? Start with what the hiring data says.

The five AI governance certifications side by side

Fees are in US dollars and cover the exam only. ISACA adds a one-time $50 application fee after you pass, and PECB charges $500 to apply for the certificate.

Can you take AAISM, AAIA or AAIR without CISA or CISM?

No. Each of ISACA's AI certifications requires an existing credential:

• AAISM: "AAISM candidates must hold an active CISM or CISSP certification," in ISACA's words.
• AAIA: an active CISA, or a designation such as CIA, US CPA or ACCA held alongside an IT audit or IT advisory role.
• AAIR: one of ISACA's CISA, CISM, CRISC, CGEIT or CDPSE, or an outside credential such as CISSP, CIA, CGRC or PMI-RMP.

ISACA's lists differ slightly between its pages and candidate guides, so check before you register. All three are on our ISACA page.

If none of these is on your CV, it's AIGP or ISO 42001 for now.

Is AIGP the right AI governance certification if you come from privacy?

Often, yes. Without an ISACA or ISC2 credential, it's one of only two options on this list.

Your privacy background carries over to a lot of it. One of the four domains is about how laws, standards and frameworks apply to AI: existing privacy law, intellectual property, nondiscrimination, consumer protection, and AI-specific laws such as the EU AI Act. It even covers ISO 42001 as one of the standards.

The new material is elsewhere: two of the four domains are about governing how AI is built and how it's deployed: impact assessments, training data, testing, monitoring and incident management.

The exam is 100 questions in 165 minutes, at a Pearson VUE center or online through OnVUE. Certification lasts two years from the day after you pass. Our AIGP study guide covers the Body of Knowledge in detail, and the AIGP practice exam guide shows how to find the domains that are new to you.

If you'd rather start with privacy itself, IAPP's privacy certifications have their own guides: CIPP/E, CIPM and CIPT guides.

What's the difference between AAISM, AAIA and AAIR?

All three share the same format, pass mark and fee. What differs is the job each one is for, and the domain weights show it.

AAISM is for people who run security. It splits into AI Governance and Program Management (31%), AI Risk and Opportunity Management (31%) and AI Technologies and Controls (38%). ISACA calls it "the first and only AI-centric security management certification." If you searched for an AI security certification, this is the one. AAISM practice questions

AAIA is for auditors. Nearly half of it (46%) is AI Operations: data management, change management, testing and incident response for AI systems. The rest is AI Governance and Risk (33%) and AI Auditing Tools and Techniques (21%). AAIA practice questions

AAIR is the newest, launched in April 2026, and it's for risk professionals. The largest domain is AI Risk Program Management (42%), followed by AI Risk Governance and Framework Integration (37%) and AI Life Cycle Risk Management (21%). AAIR practice questions

The simple version: AAISM builds and runs the controls, AAIA checks them, and AAIR decides which risks matter and what to do about them.

Is ISO 42001 a certification for people or for companies?

Both. A company has its AI management system certified against ISO/IEC 42001 through an audit. A person takes an exam about the standard, such as PECB's ISO/IEC 42001 Lead Auditor.

The Lead Auditor exam is mostly about auditing. Of its 80 questions, 20 cover the AI management system itself and 60 cover audit principles and preparing, running, closing and managing audits. It's open book: you can bring a hard copy of the standard, the course materials and your own course notes. You need 70% to pass.

There's no prerequisite to sit it, but the title you get depends on your experience. With none, you're a Provisional Auditor. The full Lead Auditor title needs five years of professional experience, two of them in AI management, plus 300 hours of AI management system audits. The certificate lasts three years.

It suits auditors, compliance managers and consultants, and anyone whose company is heading for ISO/IEC 42001 certification. PECB's other management system exams are on our PECB page. ISO/IEC 42001 Lead Auditor practice questions

Which AI governance certification fits your job?

If two rows fit, try five questions for each (links in the next section).

Try five questions before you book

These exams cost $459 to $1,000, a lot to spend on a guess. Before you register, answer five exam-style questions for the one you're leaning toward. No account needed.

• AIGP: privacy, legal, policy and compliance
• AAISM: security managers with CISM or CISSP
• AAIA: IT auditors with CISA or a listed designation
• AAIR: risk professionals with a listed credential
• ISO/IEC 42001 Lead Auditor: auditors and anyone preparing a company for ISO/IEC 42001

If the questions read like your job, book that exam. If most feel foreign, try the next one before you pay for anything.

Frequently asked questions