IAPP Artificial Intelligence Governance Professional (AIGP)
IAPP Artificial Intelligence Governance Professional (AIGP) is the IAPP's AI governance credential, ANSI/IAS accredited, and the working baseline for privacy professionals adding AI risk to their portfolio. Four official domains: understanding the foundations of AI governance, understanding how laws/standards/frameworks apply to AI, understanding how to govern AI development, and understanding how to govern AI deployment and use. The exam is 100 multiple-choice questions (including case studies), 3 hours. IAPP updated the Body of Knowledge to version 2.1 effective February 2, 2026 with expanded EU AI Act coverage; the four domain names below are structural and verified against the primary-source v2.0.1 Body of Knowledge and Exam Blueprint.
This exam is given in English only.
Owner: IAPP · Read: · Source: AIGP Exam - IAPP Store
Exam fee at last check: $649 for members and $799 for non-members, per the vendor. The official objectives are at iapp.org/certify/aigp/. Verified 2026-10-25.
Practice is free. The full analysis adds the right answer, the explanation and the source for every question, readiness by domain and a study plan, for one payment.
- Understanding the Foundations of AI Governance16-20 of 100 questions
- Understanding How Laws, Standards and Frameworks Apply to AI19-23 of 100 questions
- Understanding How to Govern AI Development21-25 of 100 questions
- Understanding How to Govern AI Deployment and Use21-25 of 100 questions
Source: Vendor exam objectives. Checked 2026-10-25. Bar length is relative to the heaviest domain; the figure beside each name is the published weight.
What's on the exam
Understanding the Foundations of AI Governance 16-20 of 100 questions
What AI governance is: why AI needs governance, organizational expectations, and life-cycle policies and procedures.
- Generally accepted definitions and types of AI, and the risks and harms AI poses (misalignment, ethics/bias, complexity, scalability)
- Unique AI characteristics requiring governance: complexity, opacity, autonomy, speed/scale, data dependency, probabilistic vs deterministic outputs
- Common principles of responsible AI: fairness, safety and reliability, privacy and security, transparency and explainability, accountability, human-centricity
- Roles and responsibilities across AI governance stakeholders, and differentiating developers, deployers, and users
- Policies spanning the full AI life cycle: use case assessment, risk management, ethics by design, data acquisition, model development, training/testing, deployment/monitoring, documentation, incident management
Primary sources: IAPP AIGP Body of Knowledge and Exam Blueprint v2.0.1, NIST AI 100-1 AI Risk Management Framework
Understanding How Laws, Standards and Frameworks Apply to AI 19-23 of 100 questions
Existing data privacy, IP, non-discrimination, consumer protection, and product liability law as applied to AI; the EU AI Act; and the major industry standards and frameworks.
- Existing data privacy law applied to AI: notice/choice/consent, purpose limitation, data minimization, controller obligations, sensitive-data rules
- Other existing law applied to AI: IP law, non-discrimination law (employment, credit, housing, insurance), consumer protection, product liability
- EU AI Act risk classification (prohibited, high-risk, limited-risk, minimal-risk), GPAI model requirements, enforcement and penalties
- OECD Principles on AI, NIST AI RMF and Playbook, NIST ARIA, ISO/IEC 22989 and 42001
Primary sources: IAPP AIGP Body of Knowledge and Exam Blueprint v2.0.1, EU AI Act (Regulation 2024/1689)
Understanding How to Govern AI Development 21-25 of 100 questions
The largest single domain, tied with deployment: governing the design, building, training, testing, release, monitoring, and maintenance of an AI model.
- Governing design and build: business context, impact assessment, applicable laws, architecture/model selection, risk mitigation hierarchy, documentation
- Governing data collection and use in training/testing: data governance, lineage and provenance, unit/integration/validation/performance/security/bias testing
- Governing release, monitoring, and maintenance: model cards, conformity assessment, continuous monitoring, audits, red teaming, threat modeling, incident documentation, public disclosures
Primary sources: IAPP AIGP Body of Knowledge and Exam Blueprint v2.0.1, NIST AI 600-1 GenAI Profile (July 2024)
Understanding How to Govern AI Deployment and Use 21-25 of 100 questions
Responsibilities when selecting, deploying, and using an AI model, whether proprietary or third-party, through ongoing monitoring and eventual deactivation.
- Evaluating deployment factors: use-case context, model type differences (classic vs generative, proprietary vs open source), deployment options (cloud/on-prem/edge), fine-tuning vs RAG
- Assessing the model before deployment: impact assessment, applicable laws, vendor/open-source agreement terms, proprietary-model liability exposure
- Governing deployment and use: data governance, risk/issue management, user training, continuous monitoring, audits and red teaming, unintended-use forecasting, external communication, deactivation/localization policy
Primary sources: IAPP AIGP Body of Knowledge and Exam Blueprint v2.0.1, NIST AI 600-1 Manage function (Section 4)
Exam-day strategy
Domains III and IV (governing development and governing deployment/use) are each 21-25 of the 100 questions, roughly half the exam between them. Know the III.A/III.B/III.C and IV.A/IV.B/IV.C sub-competencies cold.
Read each question for which AI RMF function or which law it is testing. AIGP questions often turn on whether a control sits in GOVERN, MAP, MEASURE, or MANAGE.
For EU AI Act questions, identify the risk tier first (prohibited, high-risk, limited-risk transparency, minimal-risk), then check whether the question is actually about the separate GPAI model requirements.
For Colorado AI Act and state-law questions, focus on developer vs deployer obligations. Many distractors swap those roles.
Watch for fairness-criterion swaps: demographic parity vs equal opportunity vs equalized odds are tested repeatedly and the distinctions are precise.
Distinguish Domain III (governing the model you are building) from Domain IV (governing a model, proprietary or third-party, that you are deploying); several distractors swap which domain's obligations apply.
Pace at roughly 100 seconds per question. 100 questions in 3 hours is generous; flag and return on tough ones.
How to prepare for IAPP Artificial Intelligence Governance Professional (AIGP)
- EVIDENCE-BACKEDPractice in the same format as the exam. How well practice matches the final test shapes how much it helps. (Yang et al., 2021)
- EVIDENCE-BACKEDStart practice questions in week one, even on topics you have not studied. Failed attempts before seeing the answer still helped learning. (Kornell et al., 2009 and others)
- EVIDENCE-BACKEDSpace your reviews over weeks instead of cramming the week before. (Cepeda et al., 2006 and others)
- PLAUSIBLEDivide the minutes by the questions before you start, and keep a margin for a second pass if the exam allows one. (Sound arithmetic; no study compared time budgets on a licensing exam.)
Why this works
EVIDENCE-BACKED At least one peer-reviewed study or official source found the effect or states the fact. A study can be small.
PLAUSIBLE Reasonable and partly studied, but not tested on exams, or the results are mixed.
Practice that matches the final test format works better than practice that does not.
Failed attempts before seeing the answer still improved later learning of the material asked about; the benefit for material not asked about was virtually nil.
Spacing beat massing across hundreds of experiments and beat cramming with flashcards; combined with retrieval it raised scores on a real high-stakes exam.
Sound arithmetic; no study compared time budgets on a licensing exam.
Sources
- Yang, C., Luo, L., Vadillo, M. A., Yu, R., & Shanks, D. R. (2021). Testing (quizzing) boosts classroom learning: A systematic and meta-analytic review. Psychological Bulletin, 147(4), 399-435. doi.org/10.1037/bul0000309
- Kornell, N., Hays, M. J., & Bjork, R. A. (2009). Unsuccessful retrieval attempts enhance subsequent learning. Journal of Experimental Psychology: Learning, Memory, and Cognition, 35(4), 989-998. doi.org/10.1037/a0015729
- Richland, L. E., Kornell, N., & Kao, L. S. (2009). The pretesting effect: Do unsuccessful retrieval attempts enhance learning? Journal of Experimental Psychology: Applied, 15(3), 243-257. doi.org/10.1037/a0016496
- St. Hilaire, K. J., Chan, J. C. K., & Ahn, D. (2024). Guessing as a learning intervention: A meta-analytic review of the prequestion effect. Psychonomic Bulletin & Review, 31(2), 411-441. doi.org/10.3758/s13423-023-02353-8
- Cepeda, N. J., Pashler, H., Vul, E., Wixted, J. T., & Rohrer, D. (2006). Distributed practice in verbal recall tasks: A review and quantitative synthesis. Psychological Bulletin, 132(3), 354-380. doi.org/10.1037/0033-2909.132.3.354
- Kornell, N. (2009). Optimising learning using flashcards: Spacing is more effective than cramming. Applied Cognitive Psychology, 23(9), 1297-1317. doi.org/10.1002/acp.1537
- Kang, S. H. K. (2016). Spaced repetition promotes efficient and effective learning: Policy implications for instruction. Policy Insights from the Behavioral and Brain Sciences, 3(1), 12-19. doi.org/10.1177/2372732215624708
- Janes, J. L., Dunlosky, J., Rawson, K. A., & Jasnow, A. (2020). Successive relearning improves performance on a high-stakes exam in a difficult biopsychology course. Applied Cognitive Psychology, 34(5), 1118-1132. doi.org/10.1002/acp.3699
Additional resources
Explore Related Cybersecurity Resources
DecipherU is independent of International Association of Privacy Professionals (IAPP). Artificial Intelligence Governance Professional (AIGP) is a trademark of International Association of Privacy Professionals (IAPP). DecipherU is not endorsed by, sponsored by, or affiliated with any certifying body.