What the exam asks, in what order to study it, how long it takes, what it costs and where candidates lose marks.
The AIGP, the Artificial Intelligence Governance Professional, is the certification for people who govern how AI systems are built, bought and used. It tests whether you can apply the law, the standards and the frameworks to a real system and a real organisation, not only whether you can recite them.
It is issued by the IAPP. There are no prerequisites: no degree and no minimum experience. You sit it online or at a test centre, in English.
Format and fees
Membership of the IAPP costs $295 a year and includes the maintenance fee; without membership that fee is $250 every two years. Members pay $649 for the exam and $475 for a retake.
The IAPP publishes a body of knowledge for each certification: the list of competencies the exam is written from, with the minimum and maximum number of questions per domain. The current version for AIGP is 2.1, in force since 2 February 2026. The 22Academy course follows it concept by concept.
What AI is and why it needs governing: how the systems work, where the risks and harms come from, the principles of responsible AI, and how an organisation sets up roles, policies and a governance programme.
The principles. Transparency, explainability and accountability are three different things, and the exam offers each as the plausible wrong answer for the others.
Which principle of responsible AI requires that a named person or function can be held to answer for the outcomes of an AI system?
Twenty more like it, freeThe rules: the EU AI Act with its risk categories and its roles, the laws that already applied before it, such as data protection, and the frameworks organisations work with, among them the NIST AI Risk Management Framework and ISO/IEC 42001.
The role. Obligations under the EU AI Act follow from being a provider or a deployer, and candidates answer for the wrong one.
Statement I: under the EU AI Act, every AI system used in recruitment is prohibited. Statement II: a deployer of a high-risk AI system must assign human oversight to people with the competence, training and authority to carry it out. Which statement is correct?
Twenty more like it, free
Domains 2, 3 and 4 each carry up to 25 of the 85 scored questions, so there is no single domain to lean on. The course shows your accuracy per domain and per module, and points at the module to work on now.
Governance while the system is being built: defining the use case, governing the data, training and testing, documentation, and the decision to release.
The documents. A model card, technical documentation and a data sheet answer different questions for different readers, and the exam asks which one fits.
A team is about to train a credit-scoring model and finds that one region is barely represented in the training data. What should it do before training continues?
Twenty more like it, freeGovernance once the system is in use: the decision to deploy, assessing vendors, monitoring in production, handling incidents and taking a system out of service.
Responsibility after go-live. Buying a system from a vendor does not move the deployer's duties to the vendor.
A hospital uses a triage system from a vendor and notices that its accuracy is falling for older patients. What is the BEST first step for the hospital as deployer?
Twenty more like it, freeNot using your IAPP membership? Pay only the $250 maintenance fee and keep $340 every two years.
Start AIGP freeThe EU AI Act comes back in every domain. Know these four groups of articles and the scenario questions become readable.
The uses of AI that are banned outright, such as social scoring and manipulative techniques.
When a system is high-risk: a safety component of a regulated product, or a use on the list.
Risk management, data governance, technical documentation, record-keeping, human oversight, accuracy and robustness.
What each role must do, including the fundamental rights impact assessment for certain deployers.
Telling people they are dealing with an AI system, and marking generated content.
The duties of model providers, and the extra duties for models with systemic risk.
The body of knowledge names frameworks and standards next to the law, and they are examinable. Knowing what each one is for matters more than memorising its clauses.
Four functions: Govern, Map, Measure and Manage. Governance runs across the other three.
The international standard for an AI management system, and the one an organisation can be certified against.
The international baseline for trustworthy AI, and the source of the definition of an AI system used in law.
A global ethical framework, adopted by the UNESCO member states.
The seven requirements of the EU High-Level Expert Group, the forerunner of the EU AI Act.
The risks specific to generative AI, mapped to the four functions.
AI has little case law of its own yet. These decisions show how courts apply existing law to automated systems.
A credit score is itself an automated decision under Article 22 of the GDPR when the lender relies heavily on it.
A person is entitled to a real explanation of the logic behind an automated decision about them.
A welfare fraud risk-scoring system was struck down for lack of transparency, under the right to private life.
A court may use a proprietary risk score in sentencing, but only with warnings about its limits.
Lawyers were sanctioned for filing case citations that a chatbot had invented.
An airline was held to the wrong information its own chatbot gave a customer.
Every explanation in the course is stored once and linked to its source. When a regulation, a guideline or a decision changes, we update it in one place and every lesson that uses it is correct from that moment.
Exam questions come in a small number of structures, and a candidate who knows the content can still lose marks on the structure. The course tags every question with its structure; the technique is one tap away on each one, and every test shows whether you lost the mark on the content or on the type of question.
Buy the exam voucher when you are ready, not before. It expires a year after you buy it.
Free AIGP assessmentThe IAPP recommends at least 30 hours of study. People who already work in privacy or with AI systems need less; people new to both need more. At three hours a day you can be ready in about five weeks.
Book the exam before you feel ready: a fixed date concentrates the effort. You have twelve months from purchase to sit it.
Or €117 a month with a trial exam included.
A five-week plan, at three hours a day
A guideline. The course builds your own plan from your assessment and the hours you have.
| Resource | Price | Worth it? |
|---|---|---|
| AIGP body of knowledge | Free | Essential. Work through it competency by competency. |
| The EU AI Act itself | Free | No substitute. Read the articles against the recitals. |
| NIST AI Risk Management Framework | Free | Examinable, and short enough to read in full. |
| ISO/IEC 42001 | Paid standard | Know its purpose and structure. You do not need to buy it for the exam. |
| IAPP official training | From $995 | A good introduction. It does not replace practice under time pressure. |
| IAPP practice exam | IAPP store | One exam, useful for the house style of the questions. |
| 22Academy AIGP course | €37 a week or €117 a month | The full course, the exam skills, the measurement and a trial exam. Stop when you are ready. |
| 22Academy trial exam | €42, or free with a monthly plan | Full length under real conditions, with analysis by domain and by question type. |
If you fail, fail cheap. Ten trial exams cost less than one retake.
Buy a trial examThe AIGP is the certification for anyone whose job depends on AI being used responsibly. It leads into AI governance roles, the newest careers in this field, and it adds to the roles that already carry responsibility for data: the data protection officer and the head of privacy are the people organisations turn to first when AI arrives.
Employers ask for it because it shows that you can turn a regulation and a framework into decisions about a real system. Pay rises with the scope of the role.
Each role page shows which certifications it takes, in which order, and how long it takes.
| Certification | What it covers | Take it when |
|---|---|---|
| AIGP | AI governance | Your organisation builds or uses AI |
| CIPP/E | European data protection law | You advise on the law, or want the legal foundation first |
| CIPP/US | United States privacy law, federal and state | You work with American data, clients or colleagues |
| CIPM | Running a privacy programme | You run privacy rather than advise on it |
| CIPT | Privacy in technology | You build or run the systems |
Not sure? The career plan starts from the job you want.
Free account, fifteen minutes, your score per domain.
About 1 minute 40 seconds a question. Flag and move on.
Removing what is wrong is faster than hunting for what is right.
Most, best, primary and except decide what is being asked.
Fifteen minutes at the midpoint. The first half is submitted for good.
Online or at a test centre: both work. If you sit online, do a full dry run the day before, and disconnect second screens and docking stations.
Passed? You keep the certification with 20 CPE credits in every two-year period, plus the maintenance fee or an IAPP membership that includes it.
Not this time? A retake costs $625, or $475 for IAPP members, and your progress in the course is still there.
“A must have tool for AIGP test preparation”
It is demanding rather than hard. The material is new to almost everyone: lawyers meet the technology for the first time, and technologists meet the law. Most of the effort goes into vocabulary and roles, knowing exactly what a provider is, which risk category applies and which framework does what. The rest is applying those rules to a messy scenario under a clock, so candidates who practise on exam-style questions early do far better than those who only read.
No. There are no prerequisites, no degree and no minimum experience. The exam asks what an AI system does and where it can go wrong, not how to build one. Candidates come from privacy, law, compliance, risk, security, product and management, and the course explains every concept in plain language as well as in its formal form.
No. The AIGP stands on its own. The CIPP/E does help, because the exam returns to data protection in several places, such as automated decisions and impact assessments. If you work with European data, the two together are a strong combination, in either order.
The IAPP offers traditional classroom courses and e-learning in which the content is presented to you. We start from the fact that you already have access to all the content, so we focus on getting it into your head rather than throwing more of it at you. We test your knowledge constantly, because that is what makes it stick, and we explain every concept in the form and length that suits you. We also teach the exam skills: how the questions are built, what they are really asking and where the traps are. And we embrace AI for your study, because you use it already; we show you how to use it more effectively.
Practice questions check your knowledge one item at a time. The trial exam checks whether you can answer one hundred in a row under the clock, the way the real exam asks it. Its analysis shows whether you lose marks on the content or on the type of question, so you know exactly what to work on in the last days. It is the last check before you book.
Yes, and we encourage it. An AI app is a good partner for rehearsing: it will quiz you, rephrase a concept or test you on a passage you give it. It is a poor judge of whether you are ready, because it cannot tell you what you failed to ask. The course gives you prompts that make your own app quiz you properly, and measures you with its own questions.
Yes. You can start your course for free and see whether the system suits you: the assessment and the first lesson are open without a card. When you want the rest, the course is €37 a week, or €117 a month with a trial exam included.
Yes. You pay for the weeks or months you study and cancel whenever you like; your access runs to the end of the period you paid for. If you come back within a year, your progress is still there.
No. The IAPP owns the AIGP and sets the exam. 22Academy prepares candidates for it independently, and has done so since 2018.
More in the FAQ.
How to plan around a job, when to book the exam, whether you are ready: connect and ask. Support is free!
Free account, fifteen minutes, your score per domain.