AIGP Exam Guide 2026: FREE IAPP AI Governance Prep

The AIGP Is the First Real AI Governance Credential — Here Is How to Pass It in 2026

The IAPP AIGP (Artificial Intelligence Governance Professional) is the most recognized AI governance certification on the planet. Launched at the IAPP Global Privacy Summit on 4 April 2024, it has become the credential that privacy, compliance, risk, and AI leaders put on their LinkedIn profiles in 2026 — for a simple reason. The EU AI Act high-risk provisions hit enforcement in August 2026, NIST AI RMF adoption is accelerating, ISO/IEC 42001 AI management systems are expanding, and every large organization needs someone who can translate "we are going to use AI responsibly" into actual controls, policies, documentation, and monitoring.

This guide covers the AIGP Body of Knowledge v2.1 (effective 2 February 2026), the new 4-domain structure, verified 2026 pricing, the question breakdown, an 8-week study plan, and a management-mindset coaching approach that separates first-time passers from retakers. Every number in this guide was verified against iapp.org/certify/aigp, the IAPP Store, and the official AIGP BoK v2.1 PDF.

free AIGP practice questionsPractice questions with detailed explanations

---

AIGP Exam At-a-Glance (2026)

All figures verified against the official IAPP AIGP page, the IAPP Store, the IAPP Certification FAQs, and AIGP BoK v2.1 (approved 9 September 2025, effective 2 February 2026).

---

FREE AIGP Prep: Start Here

Before spending $799 as a non-member on the exam fee — plus another $200-$1,200 on training — prove to yourself you can pass. The AIGP's scenario-based questions are famously tricky: three of four answer options often look reasonable, and only one aligns with the responsible AI governance framework IAPP expects. You cannot memorize your way through that. You have to practice.

Our free AIGP practice question bank is aligned to BoK v2.1, covers all 4 domains, and includes full rationales for every correct answer plus an explanation of why each distractor fails the IAPP frame.

Start AIGP practice questions nowPractice questions with detailed explanations

---

What AIGP Actually Is — And Why It Is Not a Technical AI Certification

The AIGP validates that you can govern AI — not build it. It is the AI equivalent of CISM or CIPM: a management-and-oversight credential for people who run programs, not people who ship models. If you are looking for a credential that proves you can train a transformer, tune a RAG pipeline, or engineer a LoRA adapter, AIGP is not it. Look at Google Cloud's ML Engineer, AWS's Machine Learning — Specialty, or vendor-specific credentials.

AIGP is what you earn when your job is to:

• Build and run an AI governance program
• Interpret the EU AI Act, NIST AI RMF, and ISO/IEC 42001 for your organization
• Perform AI impact assessments and risk assessments
• Write model cards, data sheets, and conformity documentation
• Establish human-oversight and incident-response procedures for deployed AI
• Manage third-party AI vendors and supply-chain risk
• Report AI risk and compliance posture to executives, boards, and regulators

Every question on the AIGP is, at its core, a question about what a responsible AI governance professional would do in a specific scenario. The "most technical answer" is usually wrong. The "most business-aligned, risk-based, role-aware, lifecycle-appropriate answer" is almost always right.

The 2026 AI Governance Market

Three forces have made 2026 the peak year yet to earn AIGP:

1. EU AI Act enforcement is here. High-risk AI provisions hit their enforcement deadline in August 2026. Every organization offering or using AI in the EU needs someone who understands provider vs deployer obligations, risk classification, conformity assessment, post-market monitoring, and GPAI rules.

2. NIST AI RMF is operational. NIST AI RMF 1.0 (released January 2023) and the companion Playbook have become the de facto US framework for AI risk management. Federal contractors, regulated industries, and enterprise procurement increasingly require evidence of NIST AI RMF alignment.

3. ISO/IEC 42001 certification is accelerating. The world's first AI management system standard (published December 2023) now has dozens of certified organizations and is rapidly becoming the equivalent of ISO 27001 for AI programs. BoK v2.1 expanded ISO 42001 coverage to match.

On top of that, the US regulatory patchwork has thickened: the Colorado AI Act (SB 24-205), NYC Local Law 144 on AEDTs, Illinois HB 3773, California SB 942 on AI transparency, and dozens of other state-level measures. Organizations need AI governance practitioners who can operate across all of these simultaneously.

---

Who Should Take AIGP

AIGP is the right credential for people who operate — or will soon operate — at the policy, risk, and program layer of AI. Sweet spot: 3-10 years of experience in privacy, compliance, risk, legal, security, audit, or AI-adjacent product roles.

AIGP is not the right credential for: ML engineers focused on model development (pursue vendor/technical certs), pure academic researchers, or anyone who cannot yet articulate the difference between an AI provider and a deployer.

---

Eligibility: There Are None

Unlike CISM (5 years experience) or CISSP (5 years across 2 domains), AIGP has zero formal prerequisites. Anyone — literally anyone — can register, pay the fee, and sit the exam.

That said, IAPP recommends a minimum of 30 hours of study per its Certification Candidate Handbook. Realistically, most candidates who pass invest 60-100 hours. Candidates with no prior background in privacy, compliance, or AI-adjacent work should plan on 100-140 hours over 12-16 weeks.

---

The 4 AIGP Domains (BoK v2.1, Effective 2 February 2026)

IAPP restructured AIGP from 7 domains down to 4 when it released BoK v2.0.1 in February 2025. The current v2.1 (approved 9 September 2025, effective 2 February 2026) keeps the same 4-domain structure and refines specific performance indicators — it is a recalibration, not a reinvention.

Domains III and IV together = 42-50 of 85 scored questions (roughly 50-59% of the scored exam). If you prioritize study time incorrectly, this is where you lose points.

What Changed in BoK v2.1

• Performance Indicator I.C.2 — expanded to include evaluating and updating data governance and intellectual property policies for AI
• Performance Indicator I.C.3 — expanded to include updated third-party risk documents, assessments, and contracts for AI
• III.A.3 and IV.B.2 — removed as redundant with Domain II
• ISO/IEC 42001 — coverage expanded in Domain II
• Agentic AI architectures — new emphasis in Domain IV governance

If your study materials predate February 2026, you are about 90% aligned — but verify the four changes above.

---

Domain I — Foundations of AI Governance (16-20 Questions)

Domain I is the conceptual bedrock. You cannot answer Domain II-IV questions correctly without fluency in the vocabulary and principles here.

Core Topics

High-Yield: Ethical vs Responsible vs Trustworthy AI

This distinction is tested with scenario questions and catches candidates who think the three terms are synonyms. They are not.

• Ethical AI — aligned with moral principles and societal values; broader, philosophical framing
• Responsible AI — operational implementation of ethical principles (policies, controls, documentation, oversight)
• Trustworthy AI — the outcome: AI systems that are worthy of human trust because they are reliable, safe, transparent, accountable, fair, and privacy-respecting

IAPP uses these terms with precision. When a question asks "which of the following best describes a trustworthy AI outcome," the correct answer is the operational/measurable outcome — not the principle, not the policy, but the demonstrable result.

Governance Roles: Who Decides What

---

Domain II — Laws, Standards, and Frameworks Apply to AI (19-23 Questions)

Domain II is the regulatory literacy domain. You must be fluent in: existing data-privacy laws applied to AI, new AI-specific laws (EU AI Act above all), and the major frameworks (NIST AI RMF, ISO/IEC 42001, ISO/IEC 23894, ISO/IEC 22989, OECD).

Core Topics

EU AI Act: The Most-Tested Law

The EU AI Act is the centerpiece of Domain II. IAPP consistently tests:

Risk Classification (4 tiers):

Role Obligations (Provider vs Deployer):

• Providers develop or substantially modify AI systems and place them on the market. They bear the bulk of high-risk obligations.
• Deployers use AI systems under their own authority (not for personal, non-professional use). They must follow provider instructions, assign human oversight, monitor operation, and — for certain high-risk systems — conduct a fundamental rights impact assessment (FRIA).
• Importers and distributors have verification and due diligence obligations.
• GPAI providers (general-purpose AI model providers) have separate transparency and documentation obligations; providers of GPAI with systemic risk have additional model-evaluation and cyber obligations.

Memorize the fine structure (post-2024): up to €35M or 7% global turnover for prohibited AI violations; up to €15M or 3% for high-risk violations; up to €7.5M or 1% for supplying incorrect information.

NIST AI RMF 1.0: The Four Functions

NIST AI RMF is the US answer to the EU AI Act. Expect scenario questions that require you to map NIST functions to EU AI Act obligations.

ISO/IEC 42001:2023 (Emphasis Expanded in v2.1)

ISO/IEC 42001 is the AI management system standard — the "ISO 27001 of AI." Memorize:

• 10 clauses (clauses 4-10 are auditable): Context, Leadership, Planning, Support, Operation, Performance Evaluation, Improvement
• AI policy, AI objectives, AI risk assessment and treatment, statement of applicability
• Annex A controls covering AI policy, organizational roles, AI impact assessment, AI lifecycle, data for AI systems, information for interested parties, use of AI systems, third-party relationships

Requirement-to-Control Mapping (Build This)

The single highest-leverage Domain II study activity is building a requirement-to-control mapping table that aligns EU AI Act obligations with NIST AI RMF actions and ISO/IEC 42001 controls. When the exam presents a scenario, you can mentally run through the three frameworks at once and pick the best answer.

---

Domain III — Governing AI Development (21-25 Questions)

Domain III moves from theory to the practical work of governing AI systems as they are designed, built, trained, tested, and prepared for release.

Core Topics

The Go/No-Go Decision

AIGP repeatedly tests the pre-deployment go/no-go decision. The correct answer frame is always: Has every required condition been satisfied per the governance policy? Are the right artifacts complete (AIIA, model card, technical documentation, test evidence, conformity assessment where required)? Has the model owner signed off? Has the AI governance committee approved?

If any of those is missing, the correct action is almost always: halt deployment, document the gap, escalate per policy, remediate, re-review. Not: "deploy and fix post-market," and not: "overruled by the engineering lead."

Model Cards and Data Sheets (Heavily Tested)

• Model cards (Mitchell et al., Google) document intended use, evaluation data, metrics, ethical considerations, caveats, and limitations
• Datasheets for Datasets (Gebru et al.) document motivation, composition, collection process, preprocessing, uses, distribution, and maintenance
• System cards (Meta, OpenAI) extend model cards to the deployed system context
• EU AI Act technical documentation (Annex IV) is the formal regulatory equivalent for high-risk AI providers

Memorize: which artifact is expected when. Model cards = model-level. Data sheets = dataset-level. Annex IV = regulatory compliance for high-risk providers. AIIAs = impact-level before or during development.

---

Domain IV — Governing AI Deployment and Use (21-25 Questions)

Domain IV is the post-deployment operational domain — and where under-prepared candidates most commonly lose points. Many study Domains I-III thoroughly and treat Domain IV as an afterthought. That is a 25% of the scored exam mistake.

Core Topics

Human Oversight Design

The EU AI Act's human oversight requirements (Article 14 for high-risk AI) are repeatedly tested. Candidates must design oversight that enables the human overseer to:

1. Fully understand the AI system's capacities and limitations
2. Remain aware of automation bias
3. Correctly interpret the AI system's output
4. Decide not to use the AI system or override, reverse, or disregard its output
5. Intervene or halt operation via a "stop button" or equivalent

AI Incident Lifecycle

A faithful rendering of the AI incident lifecycle (heavily tested):

1. Detection — monitoring, user reports, third-party disclosure
2. Analysis — validate, classify severity, scope impact
3. Containment — pause, restrict use, route to manual review, fall back to non-AI process
4. Eradication & Recovery — root cause, corrective action, re-validation
5. Notification — internal escalation, executive, legal, regulators (per obligation), affected individuals (where required)
6. Post-Incident Review — lessons learned, control improvements, plan updates

EU AI Act Serious Incident Reporting

For high-risk AI in the EU, providers must report serious incidents (defined in Article 3) to the national market surveillance authority within specified timeframes — generally 15 days from awareness, with shorter windows for widespread infringement or death-related events. Memorize: the reporting obligation belongs to the provider, not the deployer (though deployers have immediate cooperation duties).

Third-Party AI Governance (Updated v2.1)

BoK v2.1 strengthened emphasis on third-party and vendor AI governance:

• Vendor due diligence (SOC 2 Type II, ISO 27001, ISO 42001 evidence)
• Contract clauses (data use, retraining permissions, liability, notification, audit rights)
• Continuous vendor monitoring (periodic reassessment, incident notifications)
• Sub-processor and supply-chain visibility
• Exit and data-return provisions

---

Cross-Domain High-Yield Concepts

These concepts appear across 20-30% of AIGP questions regardless of labeled domain.

The "Governance Professional Frame"

When in doubt, pick the answer that:

1. Respects role-based authority (provider vs deployer, business owner vs security, committee vs individual)
2. Follows the documented policy or runbook rather than improvising
3. Prioritizes risk-based, proportionate response over maximal or minimal
4. Ensures transparency, documentation, and accountability rather than hiding or deferring
5. Protects affected individuals (data subjects, users, third parties) as much as the organization

AI Risk Taxonomy

Metrics That Matter to the Board

Avoid the rookie mistake of reporting activity metrics to executives. Translate into business and risk outcomes:

---

Pass Rate & Difficulty Reality Check

IAPP does not publish official AIGP pass rates. Here is what we know from training providers, candidate surveys, and community data:

Plan on 60-100 hours of study. Do not schedule the exam until you are consistently scoring 75%+ on full-length timed practice exams aligned to BoK v2.1.

---

FREE AIGP Practice, Round 2

Practice is what separates first-time passers from retakers. The AIGP is a scenario-heavy exam and nothing prepares you for scenario questions except scenario questions.

Start practicing nowPractice questions with detailed explanations

---

8-Week AIGP Study Plan

This plan assumes 8-10 hours per week. Scale to 12 weeks if you are new to both AI and governance. Scale to 6 weeks if you are an experienced privacy/compliance professional already using NIST AI RMF or EU AI Act.

Week 0: Setup

• Download AIGP BoK v2.1 (free from iapp.org/certify/aigp) — print it, keep it next to your monitor
• Download the AIGP Candidate Handbook (free) — read end-to-end
• Download the IAPP AIGP Study Guide (free) — covers exam format and sample questions
• Decide: IAPP membership ($295) yes/no; register for exam slot 6-8 weeks out
• Set up free and paid practice materials; build a BoK v2.1 checklist

Week 1: Domain I (Foundations)

• Read BoK Domain I and all linked IAPP Key Terms for AI Governance
• Read NIST AI 100-1 (AI RMF 1.0) Introduction + Govern function
• Draft a one-page AI Governance Charter for a fictional organization
• Practice: 25 Domain I questions; analyze every wrong answer

Week 2: Domain I Completion + Start Domain II

• Finalize Domain I; own the Ethical vs Responsible vs Trustworthy AI distinction
• Begin EU AI Act (Articles 1-15 focus: definitions, prohibited, high-risk classification)
• Practice: 25 questions mixing Domain I and Domain II intro

Week 3: Domain II — EU AI Act Deep Dive

• EU AI Act provider vs deployer obligations; GPAI rules; enforcement and penalties
• US state AI laws survey (Colorado AI Act, NYC LL 144, Illinois HB 3773, CA SB 942)
• Privacy law intersections (GDPR Art. 22, CCPA/CPRA ADM, China PIPL automated decisions)
• Practice: 40 EU AI Act questions with rationale review

Week 4: Domain II — Frameworks + Standards

• NIST AI RMF 1.0 (4 functions), Playbook, ARIA
• ISO/IEC 42001 clauses and Annex A controls (expanded in v2.1)
• ISO/IEC 23894 (AI risk management) and ISO/IEC 22989 (terminology)
• OECD AI Principles; Council of Europe AI Convention
• Build your requirement-to-control mapping table
• Practice: 40 Domain II mixed questions

Week 5: Domain III — Governing AI Development

• AI development lifecycle, AIIA methodology
• Bias detection and mitigation (pre/in/post-processing); fairness metrics
• Model cards, data sheets for datasets, system cards, EU AI Act Annex IV technical doc
• Go/no-go scenarios: run a mock review for 3 fictional models
• Practice: 40 Domain III questions

Week 6: Domain IV — Governing AI Deployment and Use

• Human oversight models (HITL, HOTL, out-of-the-loop)
• Monitoring (drift, fairness, performance); alert thresholds
• EU AI Act Article 14 (oversight), Article 72 (post-market monitoring), serious incident reporting
• Agentic AI governance (new in v2.1)
• Third-party and procurement governance (expanded in v2.1)
• Draft an AI monitoring and incident runbook for a fictional deployed model
• Practice: 40 Domain IV questions

Week 7: Full Mock Exams + Weakness Targeting

• Take 2 full-length timed practice exams in 2h 45min blocks
• After each, spend 6 hours analyzing wrong answers by domain and by "why I got this wrong" (knowledge gap, wrong IAPP frame, misread)
• Re-study weak areas; revisit governance charter, requirement-control map, monitoring runbook

Week 8: Taper + Final Mock + Exam

• Light review only — no new material
• Day 1: final full mock exam at the same time of day you will sit the real exam; target 75%+
• Days 2-5: targeted flashcard review (EU AI Act risk classes, provider vs deployer, NIST AI RMF functions, ISO 42001 clauses, serious incident windows)
• Day 6: rest
• Day 7: exam day

---

Recommended Resources (Free-First)

Free

Paid (Only After Exhausting Free)

The lean budget stack: Official BoK v2.1 + IAPP AIGP Practice Exam ($50 member) + one community course + free OpenExamPrep practice. Total: under $200 excluding exam and membership.

---

Exam-Day Strategy: The AIGP Pacing Game

The AIGP is 100 questions in 2h 45min (165 minutes) — plus an optional 15-minute break. That is roughly 1 minute 39 seconds per question. Scenario questions can easily consume 3 minutes; knowledge questions under 30 seconds. Use the flagging feature aggressively.

Pacing

• Minute 0-55: Answer questions 1-35. Flag anything over 90 seconds and move on.
• Minute 55-110: Answer questions 36-70.
• (Optional 15-min break)
• Minute 110-155: Answer questions 71-100.
• Minute 155-165: Revisit flagged questions. First instincts are correct ~75% of the time — change answers only with concrete reason.

The AIGP Question Archetypes

Every AIGP question falls into one of three archetypes. Identify which before you answer:

The Elimination Engine

For hard questions, eliminate in this order:

1. Eliminate technical-only answers. AIGP tests governance, not ML engineering.
2. Eliminate authority-overstepping answers. The governance lead does not accept business risk unilaterally, does not bypass committee review, does not disclose publicly without counsel and executive sign-off.
3. Eliminate absolutes. "Always," "never," "all," "immediately and without review" are almost always wrong.
4. Eliminate answers that ignore role (provider vs deployer, controller vs processor). If the obligation belongs to a different role, the answer is wrong.
5. Choose the answer a responsible AI governance professional would defend to executives, regulators, and affected individuals.

OnVUE (Remote Proctor) Tips

• Test webcam, microphone, and bandwidth 24 hours before
• Clear your desk entirely — empty walls behind you, no papers, no phone, no smartwatch
• Have government photo ID ready; complete check-in 30 minutes before start
• Use a wired connection if possible; close every application except the OnVUE client
• Restroom breaks are allowed but the clock keeps running during the 15-minute scheduled break only

---

Cost Breakdown, Retake Policy & Recertification

Total First-Year Cost (Member Path)

Total First-Year Cost (Non-Member Path)

Membership Math

Membership costs $295/year and saves $150 on the exam plus $250 on the biennial CMF. It breaks even over two years and wins in year 3+ via discounted resources, lower training prices, conferences, and CPE access. If you plan to stack CIPP, CIPM, or CIPT with AIGP, membership is clearly worth it.

Retake Policy

• After a failed attempt, wait 7 days before retesting
• Retake fee: $475 member / $625 non-member
• Each purchased exam must be scheduled and taken within one year of purchase

Recertification (2-Year Cycles)

• 20 CPE credits per 2-year cycle aligned to AIGP BoK content
• Certification Maintenance Fee: $250 per term for non-members; included in IAPP membership
• All IAPP certifications share continuing-education rules; term alignment applies if you hold multiple
• CPE activities include IAPP webinars, conferences (Global Privacy Summit, AIGG Europe, AIGG Global), KnowledgeNet chapter events, IAPP training, approved university courses, writing articles, teaching, and committee service

---

Salary & Career: What an AIGP Actually Earns

IAPP's 2024 Privacy Professionals Salary Survey and 2026 job-market data converge on these US numbers:

The AIGP + CIPP Premium

IAPP's 2024 survey reports that professionals whose roles encompass both privacy and AI governance earn a median of $169,700 in base salary — roughly $18,000 more than AI-only roles ($151,800). Holding one IAPP certification correlates with ~13% higher salaries; holding multiple IAPP certifications correlates with ~27% higher salaries. AIGP + CIPP + (optionally) CIPM or CIPT is the most lucrative credential stack IAPP offers.

Career Paths

• Privacy Pro Adds AIGP: Privacy Manager → AI Governance Manager → Director of Privacy & AI. Fastest path to $170K+.
• Compliance Adds AIGP: Compliance Manager → AI Compliance Lead → Chief Compliance Officer with AI scope.
• Risk/Audit Adds AIGP: IT Risk Manager → AI Risk Lead → CRO track with AI emphasis.
• Legal Adds AIGP: Privacy Counsel → AI & Technology Counsel → General Counsel for AI-heavy organizations.
• Product Adds AIGP: Product Manager → Responsible AI Product Lead → Head of AI Product at enterprise.
• Consulting Track: AIGP + CIPP → Manager / Senior Manager at Big 4 or boutique advisory; standard at Manager level.

---

Common Mistakes That Tank First-Time Candidates

Mistake #1: Studying Outdated Materials

If your materials reference the 7-domain structure (pre-February 2025) or v2.0.1 (pre-February 2026), you are prepping for a different exam. BoK v2.1 is current as of 2 February 2026. Verify your training provider has updated.

Mistake #2: Reading Without Scenario Practice

Reading the BoK and EU AI Act cover-to-cover does NOT prepare you for scenario questions. The AIGP's scenario items are designed so three of four options look reasonable. Only structured scenario practice with full rationales builds the elimination reflex.

Mistake #3: Under-Studying Domains III and IV

Domains III (Development) and IV (Deployment/Use) total 42-50 of 85 scored questions — 50-59%. Candidates who over-invest in Domain I (Foundations) and Domain II (Laws/Frameworks) and skim the lifecycle domains routinely fail. Start Domain III by Week 5 of an 8-week plan.

Mistake #4: Memorizing Laws Without Understanding Roles

The EU AI Act is role-specific. A question about a company fine-tuning a foundation model and deploying it under its own brand has a different correct answer than a question about a company only using a vendor's AI system. Provider vs deployer vs importer vs distributor vs GPAI provider — memorize the obligation split.

Mistake #5: Treating AIGP Like a Technical Exam

The correct answer is almost never "build the most technically sophisticated AI safety guardrails." It is almost always "identify the risk, document the assessment, present options to the business and governance committee, and implement the governance-approved risk treatment." If you are picking answers like an ML engineer, you will fail.

Mistake #6: Ignoring Documentation Specifics

Model cards, data sheets for datasets, EU AI Act Annex IV technical documentation, AIIAs, FRIAs — each has a specific purpose and lifecycle stage. Questions that ask "which artifact is required at this point" have exact answers. Memorize the artifact-to-stage map.

Mistake #7: Skipping Domain IV Runbook Practice

Incident response for AI is tested heavily and candidates who have never drafted an AI monitoring and incident runbook miss repeatedly. Spend Week 6 building one for a fictional deployed system. Define KPIs, thresholds, alerts, escalation, notification, and post-incident review.

Mistake #8: Not Taking the IAPP Official Practice Exam

The IAPP Official AIGP Practice Exam ($50 member / $60 non-member) is 100 questions written by IAPP to match real exam depth and phrasing. It is the single most predictive resource of your real-exam readiness. Take it at the end of Week 7.

---

AIGP vs Adjacent Certifications

AIGP vs CIPP/E or CIPP/US

Not competing. Complementary. CIPP teaches privacy law; AIGP teaches AI governance across the lifecycle. The highest-value stack in 2026 is AIGP + CIPP, which also qualifies holders for the IAPP Fellow of Information Privacy (FIP) designation.

AIGP vs ISO/IEC 42001 Lead Implementer

AIGP is a credential attached to a person. ISO/IEC 42001 Lead Implementer is a credential attached to a project deliverable (implementing an AI management system per ISO 42001). They are complementary: AIGP gives you the governance framework literacy; 42001 Lead Implementer certifies you to build a 42001-compliant AI MS in an organization. Many AI governance professionals hold both.

Stacking Strategy

• AIGP + CIPP/E: EU-focused AI governance + privacy. Highly valued in EU-headquartered companies.
• AIGP + CIPP/US + CIPM: US-centric AI + privacy + program management. Top US stack.
• AIGP + CIPT: AI governance + privacy engineering. Great for AI-heavy product orgs.
• AIGP + ISO 42001 Lead Implementer: Governance framework + implementation credential. Consulting stack.
• AIGP + CISM / CRISC: AI governance + security management / IT risk. For security-owned AI programs.

---

Your Next Steps After AIGP

Natural follow-ups:

• CIPP/E or CIPP/US — if you do not already hold one
• CIPM — for privacy program management depth
• CIPT — for privacy-in-technology engineering depth
• ISO/IEC 42001 Lead Implementer or Lead Auditor — for implementation/audit credentialing
• Responsible AI Institute certifications — for RAII ecosystem alignment
• CISM / CRISC — if you want to own AI security and IT risk

IAPP's Fellow of Information Privacy (FIP) designation requires AIGP (or CIPT, or CIPM) plus any CIPP. FIP is the IAPP's highest credential and signals elite cross-disciplinary expertise.

---

Final CTA: Start Practicing Today

The AIGP is pass-able with a clear roadmap. The candidates who fail almost always share one trait: they studied concepts but never practiced scenarios. You can fix that right now.

Start practicing nowPractice questions with detailed explanations

The 2026 AI governance job market has more openings than qualified candidates. AIGP is the fastest credential path into those openings. The only thing between you and an AI Governance Manager title is the 100-question exam — and a study plan that actually works.

Good luck. You can do this.

---

Official Sources

• IAPP AIGP program home: https://iapp.org/certify/aigp
• IAPP Store — AIGP Exam: https://store.iapp.org/aigp-exam/
• IAPP AIGP Training: https://iapp.org/train/aigp-training
• IAPP Certification FAQs: https://iapp.org/certify/faqs
• IAPP AIGP Body of Knowledge v2.1 (effective 2 February 2026) — approved 9 September 2025
• IAPP Certification Candidate Handbook — scoring, policies, conduct
• IAPP AIGP Study Guide (free PDF): via iapp.org/l/aigp-study-guide-request
• NIST AI Risk Management Framework 1.0: https://www.nist.gov/itl/ai-risk-management-framework
• EU AI Act (Regulation (EU) 2024/1689): https://eur-lex.europa.eu
• ISO/IEC 42001:2023 AI management system standard: https://www.iso.org/standard/81230.html
• ISO/IEC 23894:2023 AI risk management guidance: https://www.iso.org/standard/77304.html
• ISO/IEC 22989:2022 AI concepts and terminology: https://www.iso.org/standard/74296.html
• OECD AI Principles: https://oecd.ai/en/ai-principles
• Pearson VUE (exam delivery): https://www.pearsonvue.com/iapp

Information current as of April 2026. Always verify specific fees, dates, and eligibility details at iapp.org/certify/aigp before registering.