Who the AIGP is for: lawyers, engineers, product people and the governance job between them

The AIGP is the IAPP's credential for the people who make an organization's use of AI governable. That job sits between the people who read the rules and the people who build, buy and ship the systems, and it usually lands on someone who already does one of those things. This guide is about who ends up in that seat, what each of them gets from the AIGP, which events put the work on their desk, and what the exam will ask of them.

The facts here come from the IAPP's AIGP Body of Knowledge and Exam Blueprint, version 2.1, its AIGP Candidate Handbook and AIGP Study Guide, the IAPP and Credo AI AI Governance Profession Report 2025, and the Official Journal text of the EU AI Act as amended by the Digital Omnibus on AI. Where this page and the IAPP differ, the IAPP's current documents win.

What does an AI governance professional actually do?

The IAPP says the AIGP "was developed to certify professionals in the field of AI governance," and that it shows an understanding of responsible management of AI systems in the U.S., the EU and other jurisdictions. Its body of knowledge breaks that work into four domains and 13 competencies, and it publishes how many exam items each domain can carry:

Read the competencies as a job description and the shape is clear. Up to half the exam, domains III and IV, is about the life of a system: how it is designed, what data trains it, how it is released, whether to deploy it at all, how it is assessed and how it is watched once it is live. Domain II is the law and the standards. Domain I is the governance machinery that holds the rest together: who decides, what the policies say, and how expectations are communicated across the organization.

That machinery looks different by size. The IAPP report treats an AI governance committee as a sign of a mature program in a larger company and notes it may be irrelevant for a smaller one. The exam does not assume one shape. It asks whether you can set expectations, write policies that cover the whole life cycle, and make them stick wherever the function sits.

That split matters for who the AIGP suits. A lawyer will find domain II familiar ground and domains III and IV new. An engineer will find the reverse. Nobody arrives knowing all four, which is the point of the credential. The AIGP exam page goes through every competency in detail.

Who ends up doing AI governance?

The most direct evidence we found on who does this work comes from the IAPP's own research. Its AI Governance Profession Report 2025, published with Credo AI, draws on the IAPP's annual governance survey from the spring of 2024, answered by more than 670 people in 45 countries and territories, plus seven company case studies. Its headline findings:

Two things stand out. The work starts before the AI does: nearly a third of organizations not yet using AI were already working on its governance. And the people doing it mostly come from somewhere else. The report says over half of respondents expected privacy, IT, security, and legal and compliance to gain responsibility, and that a strong number of privacy professionals are continually asked to take on AI governance roles. It describes the skills the job needs as an understanding of AI plus experience in governance, risk and compliance, and the ability to turn legislative requirements into policies people can act on.

We found no official labor statistic that tracks AI governance as an occupation, so the IAPP survey is the most direct evidence available. It is a survey run by a privacy association, so read the privacy findings with that in mind.

What each role brings, and what the AIGP adds

The pairings are our suggestion, not the IAPP's. They follow a simple rule: pair the AIGP with the credential for whichever half of the job you do not already have, rules or systems.

When does it start to matter?

AI governance is rarely planned years ahead. A date, a deal or a decision puts it on someone's desk.

An EU AI Act date arrives

The AI Act's prohibited practices have applied since 2 February 2025, and the general-purpose AI model rules since 2 August 2025. Most of the rest, including the Article 50 transparency duties, applies from 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the high-risk dates: systems that are high-risk under Annex III now wait until 2 December 2027, and those under Annex I until 2 August 2028. It also added two prohibitions to Article 5 that apply from 2 December 2026. Each date makes somebody ask what the organization's systems are, what role it plays for each one, and what it must have done by when.

A customer asks how you govern AI

A customer's due diligence questionnaire can ask whether a supplier has an AI policy, a register of systems and a way of assessing them. The answer has to be true, and the person who writes it needs to know what a credible answer looks like. An ISO/IEC 42001 certificate is one way to answer it; the AIGP is preparation for the person who makes the answer true either way.

The organization buys or builds its first serious system

Buying a model from a vendor does not hand the vendor your obligations. A deployer still has to assess whether a system fits its own context and keep watching it once it is live, and it cannot do that without the provider's instructions for use. Building in house makes the organization a provider as well, with the provider's documentation duties. Domain IV of the AIGP is built around that decision and that hand-off.

A general-purpose model enters the stack

The questions change when a team wants to use someone else's general-purpose model, called through an interface or built into a product the organization already uses. The AI Act's rules for providers of general-purpose AI models have applied since 2 August 2025, and Article 101 gives the European Commission its own power to fine those providers, separate from the national penalty regime in Article 99. An organization that only uses such a model is not its provider, but it still has to decide what it is building on top, what role that makes it, and what it must ask the model's provider for. Those are domain IV questions, and they arrive the day a team asks to plug a model into a customer-facing process.

Something goes wrong

An incident, a complaint about an automated decision or a regulator's question forces the governance that should already have existed. GDPR Article 22 on automated decision-making, with the Article 13(2)(f) duty to disclose it, already applies to AI systems that use personal data, so it can bite before any AI-specific rule does.

What each trigger makes you produce

Here is the same ground turned into the work it creates. For each trigger, the second column is the artifact somebody has to produce, and the third is where the AIGP teaches it.

We have turned the first questions any new system should answer into an intake checklist you can copy or download below.

Where does the credential apply?

The AIGP is international. You can sit it at a Pearson VUE testing center, of which the IAPP says there are more than 6,000 worldwide, or from home through Pearson VUE's OnVUE online proctoring. The body of knowledge is not tied to one country either. It teaches the instruments below and asks you to know which one does what:

The exam rewards knowing the difference between these. The NIST AI RMF is a framework with named functions; the ISO/IEC standards have numbers and scopes; the AI Act has articles, roles and dates. A common wrong answer attaches the right idea to the wrong instrument.

What the AIGP is not

It is not a law degree. The exam asks you to know what the laws require and how they apply to AI, but it is a governance credential. An organization still needs legal advice on its own position.

It is not an engineering credential. You will be asked how models are trained, tested and monitored, in the terms a governance professional uses. You will not be asked to write code.

It is not an organizational certificate. The AIGP is personal. An organization that wants a certificate an auditor issues looks at ISO/IEC 42001, which is a different route with a different credential for the person who leads it. Our AIGP or ISO 42001 Lead Implementer comparison sets the two side by side.

It is not only for large companies. The IAPP report notes that larger companies can split AI governance tasks across several roles, while smaller companies look for AI governance professionals who can cover all of the areas. In a small organization the AIGP holder may be the whole function, which is a reason to know all four domains well rather than the one closest to your background.

It is not permanent. The certification term is two years. It needs the maintenance fee or membership and 20 continuing education credits each term. Miss the credits and the credential is suspended; if the shortfall is not made up by the end of the next term, it is revoked and you sit the exam again.

What does it take to earn and keep?

One detail to watch: the Study Guide describes the 20 credits as an annual requirement, while the AIGP Candidate Handbook gives 20 credits per two-year term. The handbook is the AIGP-specific document, but if your renewal depends on it, check your IAPP account. The full fee picture is on our AIGP certification cost page.

How does it compare with the credentials around it?

The three overlap less than their names suggest. The CIPM is about the privacy program that many AI governance programs grow out of; the IAPP report describes organizations adding AI questions to their existing privacy assessment processes. The ISO/IEC 42001 Lead Implementer is narrower and more procedural: one standard, one management system, one audit. The AIGP is the broadest of the three, and the one built around the law as well as the system. For the CIPM's own detail, see the CIPM exam page.

What will the exam expect of you?

The AIGP has 100 questions in three hours, with an optional 15-minute break midway. All are multiple choice and include case studies. Some are multi-select: the IAPP's sample asks you to pick 3 of 5 options and gives no partial credit. Each correct answer is one point, 15 of the questions are unscored, and you will not know which. The IAPP recommends a minimum of 30 hours of study, and says you may need more or less depending on your background.

Precision is what the questions test. The AI Act assigns duties by operator role, so a question about a firm that builds a model, sells access to it and also runs it internally expects you to see that it is provider and deployer at once. A conformity assessment is the provider's demonstration that a system meets the Act's technical requirements; a fundamental rights impact assessment is a deployer-side exercise about a specific use, and the two are easy to swap under time pressure. The dates are a trap of their own since the Omnibus. Our guide's shortcut is "December means Omnibus": the two new prohibitions from 2 December 2026, and Annex III high-risk systems from 2 December 2027. Red teaming and audit are another pair: an audit measures conformance with criteria, red teaming measures resistance to adversity.

If you want to test yourself before you buy anything, our AIGP quiz has 10 questions you can do on your phone, and the AIGP mind map puts the whole exam on one page.

How to prepare

The IAPP offers in-person, live online and self-paced training, textbooks, and an official practice exam of 100 questions in the same format as the real one. Whatever you choose, start from the body of knowledge, because it is what the exam is written to, and use the item ranges to decide where your hours go.

The IAPP's own minimum is 30 hours. If you split those hours by the midpoint of each domain's item range, domain I gets about 6 hours, domain II about 7, and domains III and IV about 8 each. Treat that as the floor, not the plan. A lawyer should move hours from domain II to domains III and IV; an engineer should do the reverse. The AIGP study plan sets out a schedule built from the same item weights.

The AIGP Exam Guide (Wikidata) has 21 chapters across 397 pages, mapped to all four domains and all 13 competencies, with each competency given pages in proportion to its published item weight. It was written from the Official Journal text of the AI Act, read with the Digital Omnibus amendments, the IAPP's own Body of Knowledge and Candidate Handbook, and NIST AI 100-1, and every claim traces to a primary document named at the back. Where the blueprint names a law the book could not source independently for this edition, such as South Korea's AI Basic Law, it says so rather than guessing.

The AIGP Practice Questions (Wikidata) has 198 questions distributed to match the item counts the IAPP publishes for each competency, so your percentage tells you something an evenly spread set cannot. Every rationale says why the right answer is right and why each wrong option fails, and every answer key was checked independently.

Is it current? Both books follow Body of Knowledge 2.1, effective 2 February 2026, and the AI Act dates as amended by Regulation (EU) 2026/1744, in force from 27 July 2026. If the IAPP publishes a new body of knowledge, check its effective date against your exam date. Our AIGP certification overview and honest answer on whether it is worth it cover the decision from other angles, and the AIGP interview questions help if the credential is part of a job move.

So, do you need the AIGP?

Take it if AI governance has been added to your job, or is about to be, and you come from one side of it: privacy or law, or engineering or product. The AIGP is a structured way to learn the other side well enough to make decisions with the people who live there. Take it too if your organization faces an AI Act date with systems nobody has yet classified, because the register, the roles and the tiers are exactly what domain II and domain IV teach.

Look elsewhere first if your task is narrower. If what you have been asked for is an ISO/IEC 42001 certificate, the PECB Lead Implementer matches that job more closely. If your work is privacy operations with AI at the edges, the CIPM may serve you better now, with the AIGP as the next step. And if you only need to understand the AI Act for one project, the Official Journal text and good legal advice may be enough.

Questions people ask about the AIGP

Who is the AIGP certification for?

People who govern how an organization builds, buys and uses AI. The IAPP says there is a need for professionals in all industries to understand and execute responsible AI governance. In practice that means privacy and legal staff, compliance and risk teams, and the engineers, data scientists and product managers whose systems are being governed.

Do I need a technical background for the AIGP?

No. The IAPP sets no prerequisites for the AIGP. Domain I asks you to understand what AI is and why it needs governance, and the IAPP's sample questions test that understanding in governance terms rather than asking you to build a model.

What is the AIGP passing score?

300 on the IAPP's scale of 100 to 500. Of the 100 questions, 85 are scored and 15 are unscored. The cut score is a set number of correct scored answers, converted to 300 on the scale.

How long is the AIGP exam?

Three hours, with an optional 15-minute break midway, for 100 multiple-choice questions. Some are multi-select, and the IAPP's sample says no partial credit is given on those.

How much does the AIGP cost?

The Candidate Handbook gives USD 649 for IAPP members and USD 799 for nonmembers for a first attempt, and USD 475 or USD 625 for each retake. Nonmembers also pay a USD 250 certification maintenance fee per two-year term.

How do I keep the AIGP once I pass?

The certification term is two years from the day after you pass. To renew you pay the maintenance fee (included in IAPP membership) and submit 20 continuing education credits that match the AIGP Body of Knowledge. Up to 10 extra credits earned in the last six months of a term can carry over.

Is the AIGP only about the EU AI Act?

No. The EU AI Act is one part of Domain II, which also covers privacy law applied to AI, other existing laws, AI-specific laws in general, and industry standards and tools such as the NIST AI RMF and ISO/IEC 42001. The IAPP describes the credential as covering the U.S., the EU and other jurisdictions.

Should I take the AIGP or the CIPM?

The CIPM is the IAPP's credential for running a privacy program. The AIGP is for governing AI systems across their life cycle. If your job is mostly privacy operations, the CIPM fits; if AI systems are the thing you are being asked to govern, the AIGP does.

AIGP or ISO 42001 Lead Implementer?

The AIGP covers AI governance broadly, including law. The PECB ISO/IEC 42001 Lead Implementer is about building an AI management system that a certification body can audit. An organization can need both kinds of work; which one you need depends on whether your next task is governing systems or certifying a management system.

Is the AIGP current for 2026?

The current Body of Knowledge is version 2.1, approved on 9 September 2025 and effective from 2 February 2026, replacing version 2.0.1. Check the IAPP's AIGP page for the version that applies on your exam date.

Which books prepare you for the AIGP exam?

AIGP Exam Guide

Artificial Intelligence Governance Professional. 21 chapters, 397 pages.

What is insideBuy on Amazon

AIGP Practice Questions

198 questions with full rationales. 214 pages.

What is insideBuy on Amazon