AIGP is the first professional certification built specifically for the people responsible for governing AI. It validates that a professional understands what AI governance is, how existing and new laws and standards apply to AI, and how to govern AI across its development, deployment, and ongoing use.
The Artificial Intelligence Governance Professional (AIGP) credential is issued by the IAPP (International Association of Privacy Professionals). It is designed for professionals who develop, integrate, deploy, or oversee AI systems and AI governance programs, and who need a shared, vendor-neutral foundation across law, risk, ethics, and technical practice.
The exam is built on the AIGP Body of Knowledge and Exam Blueprint. As of version 2.1 (effective February 2, 2026), the Body of Knowledge is organized into four domains, weighted by the number of scored questions drawn from each. Open AIGP roles are listed on our AIGP jobs page, and exam facts are on the AIGP certification page.
Inside This Module: The Four Domains
Domain I16 to 20 scored questions
Understanding the Foundations of AI Governance
What AI governance is, including the common principles and pillars used to build an AI governance program that works regardless of industry, sector, or size.
- I.A, 4 to 6 questions. What AI is and why it needs governance: generally accepted definitions and types of AI; the risks and harms AI can pose to individuals, groups, organizations, and society; the characteristics that call for governance, including complexity, opacity, autonomy, speed and scale, potential for harm or misuse, data dependency, and probabilistic versus deterministic outputs; and the common principles of responsible AI: fairness, safety and reliability, privacy and security, transparency and explainability, accountability, and human-centricity
- I.B, 5 to 7 questions. Organizational expectations for AI governance: roles and responsibilities, cross-functional collaboration, a training and awareness program for all stakeholders, approaches that differ by company size, maturity, industry, products and services, objectives and risk tolerance, and the differences among AI developers, providers, deployers, and users
- I.C, 6 to 8 questions. Policies and procedures across the AI life cycle: oversight and accountability at every life cycle stage, updating existing data privacy, security, data governance and intellectual property policies for AI, and policies, assessments and contracts for third-party risk, including procurement, supply chain, human resources and acceptable use
Domain II19 to 23 scored questions
Understanding How Laws, Standards and Frameworks Apply to AI
Existing laws that apply to AI, plus AI-specific laws, standards, and frameworks. Version 2.1 names the EU AI Act, the South Korean AI Basic Law, and federal and state AI laws that apply to private-sector organizations as examples of current AI laws.
- II.A, 4 to 6 questions. Existing data privacy laws: transparency, choice, lawful basis and purpose limitation; data minimization and privacy by design; data controller obligations such as privacy impact assessments, third-party processors, cross-border transfers, data subject rights, automated decision-making, incident management, breach notification and record keeping; and sensitive or special categories of data such as biometrics
- II.B, 4 to 6 questions. Other existing laws: intellectual property, nondiscrimination in employment, credit, lending, housing and insurance, consumer protection, and product liability
- II.C, 6 to 8 questions. The main elements of AI-specific laws: the risk classification framework (prohibited, high, limited and minimal risk); requirements for risk management, data governance, technical documentation, conformity and impact assessments, record keeping, human oversight, transparency and notification, and quality management; general-purpose AI models; enforcement and penalties; and how duties differ for providers, deployers, importers, and distributors
- II.D, 3 to 5 questions. Industry standards and tools: the OECD principles for trustworthy AI, the NIST AI Risk Management Framework and Playbook, and the core ISO AI standards: ISO/IEC 22989, ISO/IEC 42001, and ISO/IEC 42005
Domain III21 to 25 scored questions
Understanding How to Govern AI Development
The responsibilities of AI governance professionals for designing, building, training, testing, and maintaining AI systems.
- III.A, 6 to 8 questions. Govern the design and build of the AI system: business context and use case, impact assessments, policies and ethical considerations in design (including architecture and model selection and human oversight), identifying and managing internal and external risks, and documenting the process
- III.B, 6 to 8 questions. Govern data in training and testing: data governance requirements, including lawful rights to use data and data quality and fit-for-purpose; data lineage and provenance; planning and performing training and testing; managing issues and risks; and documenting the results
- III.C, 8 to 10 questions. Govern release, monitoring and maintenance: readiness and conformity (model cards), continuous monitoring and a schedule for maintenance, updates and retraining, periodic audits, red teaming, threat modeling and security testing, managing and documenting incidents, understanding why incidents arise, and public transparency disclosures
Domain IV21 to 25 scored questions
Understanding How to Govern AI Deployment and Use
Responsibilities for selecting an AI model, then deploying and using it responsibly through ongoing monitoring, maintenance, and other obligations, whether the model is proprietary or from a third party.
- IV.A, 6 to 8 questions. Key factors and risks in the decision to deploy: use-case context, including business objectives, performance requirements, data availability, ethics and workforce readiness; differences in AI model types (classic vs. generative, proprietary vs. open source, small vs. large, language vs. multimodal); and deployment options (cloud, on-premise or edge, and using a model as is or with fine-tuning, retrieval-augmented generation, agentic architectures, or other techniques)
- IV.B, 5 to 7 questions. Assess the AI system: impact assessment, key terms and risks in the vendor or licensing agreement, and the added obligations and liability of deploying a proprietary model
- IV.C, 9 to 11 questions. Govern deployment and use: policies and controls, continuous monitoring and scheduled maintenance, periodic audits and red teaming, documenting incidents and post-market monitoring plans, reducing secondary and downstream harms, external communication plans, and the ability to deactivate or localize a system when required
Core Concepts You'll Master
AIGP is less about a single technology and more about a way of thinking: how to place any AI system inside a defensible governance program, map the laws and standards that apply, and manage risk across the model's full life cycle from design to deployment to retirement.
Governance
Master the responsible-AI principles (fairness, safety and reliability, privacy and security, transparency and explainability, accountability, human-centricity), and how governance responsibilities differ for developers, providers, deployers, and users of AI.
Risk Management
Be fluent in AI impact assessments, bias and harm identification, human oversight, third-party and vendor risk, and the difference between deploying an open-source model versus building your own.
Frameworks
Know the core frameworks cold: the EU AI Act's risk tiers and high-risk requirements, the NIST AI Risk Management Framework and Playbook, the OECD AI principles, and the ISO/IEC 22989, 42001 and 42005 standards.
Security Leadership
Understand how to stand up an AI governance program: roles and responsibilities, cross-functional collaboration, policies across the life cycle, training and awareness, and incident and post-market monitoring.
Exam at a Glance
| Questions | 100 |
| Duration | 2 hours 45 minutes, plus a 15-minute break |
| Format | Multiple choice |
| Passing score | Scored on a 100 to 500 scale; 300 is passing |
| Experience required | No formal prerequisites. IAPP recommends prior experience in AI, privacy, data governance, or compliance. |
Download the AIGP Reference & Study Guide (PDF)
Volume I: the exam at a glance, all four domains with their scored-question ranges, and the study essentials. Opens a PDF file.
Get the PDF →
Practice with the free AIGP game
72 timed questions and 60 flashcards across all four domains. No signup, plays on your phone.
Play the game →
Get notified when new Academy modules launch
We announce new certification modules, study resources and GRC career guides in the weekly GRC Careers newsletter.
Join the weekly newsletter
Where AIGP Takes You
- AI Governance Manager / Lead: Builds and runs the AI governance program across legal, risk, data, and engineering.
- Responsible AI Manager: Operationalizes responsible-AI principles into policy, review, and controls.
- AI Risk / Model Risk Manager: Assesses and manages AI risk across the model life cycle.
- Privacy or Compliance leader expanding into AI: AIGP is the natural bridge from privacy, GRC, or audit into AI oversight.
- AI Policy / Regulatory Analyst: Tracks and interprets the EU AI Act, NIST, ISO, and emerging AI law.
AIGP validates AI-governance knowledge; it does not by itself qualify anyone for a role. Hiring managers still weigh experience, judgment, and domain depth.
AIGP, the Artificial Intelligence Governance Professional credential, and IAPP are trademarks of the International Association of Privacy Professionals. GRC Careers is not affiliated with, endorsed by, or sponsored by IAPP.
Domain structure first written against IAPP's AIGP Body of Knowledge version 2.0.1 (verified August 6, 2026). Domain names, scored-question ranges, competencies, and performance indicators checked November 7, 2026 against version 2.1, effective February 2, 2026, which supersedes 2.0.1. Exam format, fees, scoring, and maintenance verified against IAPP published sources on August 6, 2026. Confirm current fees on the IAPP store before registering.
This is an original GRC Careers Academy module. It contains no real exam questions.
AI Governance Academy