100+ Free ISACA AAIR Practice Questions
Pass your ISACA Advanced in AI Risk (AAIR) exam on the first try — instant access, no signup required.
Which is the best description of overfitting in a supervised model?
Explore More ISACA Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.
Key Facts: ISACA AAIR Exam
90
Exam Questions
Multiple-choice format
150 min
Time Limit
2.5 hours via PSI
450/800
Passing Score
Scaled score scale
$575
Member Fee
$760 non-member + $50 application
Apr 15 2026
Exam Launch
Newly released ISACA credential
PSI
Test Provider
In-person or remote proctored
ISACA's Advanced in AI Risk (AAIR) is a newly launched advanced credential that debuted on April 15, 2026 and is delivered by PSI as a 90-question, 2.5-hour exam scored on an 800-point scale (passing 450). The exam covers three domains — AI Risk Governance and Framework Integration, AI Lifecycle Risk Management, and AI Risk Program Management — and tests NIST AI RMF, ISO/IEC 42001, the EU AI Act, OWASP LLM Top 10, MITRE ATLAS, and AI program management practices. AAIR has a hard prerequisite: candidates must hold one of approximately 25 qualifying ISACA-recognized designations (CISA, CISM, CRISC, CGEIT, CDPSE, CISSP, CRMA, CGRC, CIPP, etc.) and complete the exam within a 6-month eligibility window. The fee is $575 for ISACA members and $760 for non-members, plus a $50 application fee.
Sample ISACA AAIR Practice Questions
Try these sample questions to test your ISACA AAIR exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1Which NIST AI Risk Management Framework (AI RMF 1.0) function establishes organizational culture, accountability structures, and AI risk management policies?
2Under the EU AI Act, which article enumerates AI practices that are prohibited as posing unacceptable risk?
3ISO/IEC 42001:2023 establishes requirements for which organizational capability?
4Which standard provides guidance specifically for AI risk management aligned to ISO 31000?
5The EU AI Act entered into force on which date, marking the start of its phased applicability schedule?
6Under the EU AI Act, a general-purpose AI (GPAI) model is presumed to have systemic risk when training compute exceeds which threshold?
7Which characteristic of trustworthy AI in NIST AI RMF 1.0 is most directly concerned with the AI system's resilience to adversarial inputs and unexpected conditions?
8What is the maximum administrative fine under the EU AI Act for non-compliance with the prohibited AI practices in Article 5?
9Which OECD AI Principles value-based principle most directly addresses the goal that AI systems should respect the rule of law, human rights, and democratic values?
10GDPR Article 22 grants data subjects the right not to be subject to a decision based solely on which type of processing?
About the ISACA AAIR Exam
The ISACA Advanced in AI Risk (AAIR) credential validates advanced practitioner skills for managing AI risk across governance, lifecycle, and program dimensions. The 90-question, 2.5-hour exam covers NIST AI RMF 1.0, ISO/IEC 42001, ISO/IEC 23894, the EU AI Act, GDPR Article 22, OMB M-25-21, sectoral guidance (FDA AI/ML SaMD and SR 11-7), AI risk taxonomies, the AI lifecycle, fairness and robustness testing, OWASP Top 10 for LLM Applications, MITRE ATLAS, AI red teaming, model cards, datasheets for datasets, third-party AI vendor due diligence, and ISACA's Digital Trust Ecosystem Framework. AAIR is delivered by PSI in person or via remote proctoring with a 450/800 scaled passing score.
Assessment
90 multiple-choice questions across three domains: AI Risk Governance and Framework Integration, AI Lifecycle Risk Management, and AI Risk Program Management
Time Limit
2.5 hours (150 minutes)
Passing Score
450 / 800 scaled score
Exam Fee
$575 member / $760 non-member + $50 application fee (ISACA / PSI)
ISACA AAIR Exam Content Outline
AI Risk Governance and Framework Integration
NIST AI RMF 1.0 functions and trustworthy characteristics; NIST AI 600-1 generative AI profile; ISO/IEC 42001 AIMS; ISO/IEC 23894, 23053, 24029, 42005, 5338, 22989; EU AI Act risk tiers (Articles 5/6/9/13/14/27/52), Annex III high-risk areas, GPAI and systemic-risk threshold (10^25 FLOPs), penalties up to 7% turnover, phased timeline (Aug 1 2024 → Feb 2 2025 → Aug 2 2025 → Aug 2 2026 → Aug 2 2027); GDPR Article 22; US Executive Order 14110 revocation and OMB M-25-21; AI Bill of Rights; OECD AI Principles; sectoral guidance (FDA AI/ML SaMD, SR 11-7); AI policy integration
AI Lifecycle Risk Management
AI risk taxonomy (data/model/deployment/third-party/societal); AI lifecycle stages; data risks (bias, privacy, drift, poisoning, leakage, datasheets for datasets); model risks (overfitting/underfitting, accuracy/precision/recall/F1/AUC, fairness — demographic parity, equal opportunity, equalized odds, disparate impact, four-fifths rule); deployment risks (evasion, prompt injection, jailbreaking, model extraction, membership inference); monitoring (PSI, KL divergence, concept drift, A/B testing); AI red teaming; MITRE ATLAS; OWASP Top 10 for LLM Applications (LLM01-LLM10); explainability with SHAP/LIME; differential privacy and federated learning
AI Risk Program Management
Program charter, governance, three lines of defense for AI; KRIs/KPIs and board reporting; AI risk register and risk appetite; AI ethics committee; AI model inventory; third-party AI risk and vendor due diligence; AI vendor contractual provisions (DPAs, training-use restrictions, incident notification); model cards; datasheets for datasets; control mapping across NIST AI RMF, ISO/IEC 42001, EU AI Act, and OWASP LLM Top 10; ISACA Digital Trust Ecosystem Framework; post-market monitoring; AI incident response; awareness training; shadow AI; model retirement
How to Pass the ISACA AAIR Exam
What You Need to Know
- Passing score: 450 / 800 scaled score
- Assessment: 90 multiple-choice questions across three domains: AI Risk Governance and Framework Integration, AI Lifecycle Risk Management, and AI Risk Program Management
- Time limit: 2.5 hours (150 minutes)
- Exam fee: $575 member / $760 non-member + $50 application fee
Keys to Passing
- Complete 500+ practice questions
- Score 80%+ consistently before scheduling
- Focus on highest-weighted sections
- Use our AI tutor for tough concepts
ISACA AAIR Study Tips from Top Performers
Frequently Asked Questions
What is the ISACA Advanced in AI Risk (AAIR) certification?
AAIR is a newly launched ISACA credential, released April 15, 2026, designed for advanced practitioners who manage AI risk. It validates skills across AI risk governance, AI lifecycle risk, and AI risk program management. The exam is delivered by PSI in person or remotely as a 90-question, 2.5-hour test scored on an 800-point scale with a passing score of 450.
What are the prerequisites to sit for the AAIR exam?
AAIR has a hard prerequisite: candidates must hold one of approximately 25 ISACA-recognized designations such as CISA, CISM, CRISC, CGEIT, CDPSE, CISSP, CRMA, CGRC, or CIPP. After applying, candidates must complete the AAIR exam within a 6-month eligibility window.
How much does the ISACA AAIR exam cost?
The AAIR exam fee is $575 for ISACA members and $760 for non-members, plus a $50 application fee. Optional study materials and review courses from ISACA are priced separately. Self-study using free official resources (NIST AI RMF, EU AI Act text) is possible.
What domains does the AAIR exam cover?
AAIR covers three domains: AI Risk Governance and Framework Integration (NIST AI RMF, ISO/IEC 42001, EU AI Act, sectoral regulation, policy integration); AI Lifecycle Risk Management (data/model/deployment risks, fairness metrics, monitoring, red teaming, OWASP LLM Top 10, MITRE ATLAS); and AI Risk Program Management (governance, KRIs/KPIs, model inventory, third-party risk, ethics committee, post-market monitoring, ISACA DTEF). Detailed weights are not yet published by ISACA.
How is the AAIR exam delivered and scored?
The AAIR exam is delivered by PSI either at a testing center or via remote online proctoring. It contains 90 multiple-choice questions, runs 2.5 hours (150 minutes), and is scored on a scaled 200-800 range. Candidates need a scaled score of 450 or higher to pass.
How does AAIR differ from CRISC and CISM?
CRISC focuses on enterprise IT risk and controls broadly, and CISM focuses on information security management. AAIR is AI-specific: it tests how AI risk is governed (NIST AI RMF, ISO 42001, EU AI Act), how AI lifecycle risks are managed (fairness, robustness, OWASP LLM, ATLAS), and how an AI risk program is run. Many AAIR candidates already hold CRISC or CISM as prerequisites.
How should I prepare for the ISACA AAIR exam?
Strong preparation combines: (1) reading NIST AI RMF 1.0 and the NIST AI 600-1 Generative AI Profile, (2) studying ISO/IEC 42001 and ISO/IEC 23894, (3) working through the EU AI Act risk tiers, GPAI obligations, and timeline, (4) reviewing OWASP Top 10 for LLM Applications and MITRE ATLAS, and (5) practicing AAIR-style questions across all three domains. ISACA's official AAIR study guide and review questions are recommended.