AIGP Body of Knowledge v2.1: What Changed in February 2026

IAPP updates its Bodies of Knowledge every year. Most updates are refinements, and IAPP training partners note that annual changes usually affect no more than 10–15% of the exam. Version 2.1 fits that pattern, but its changes fall exactly where outdated study materials are weakest: laws beyond the EU, standards, and how AI systems behave in deployment.

What stayed the same in BoK v2.1

The structure is unchanged. The AIGP still tests four domains:

The exam format hasn't changed either: 100 questions (85 scored), 2 hours 45 minutes, and a passing scaled score of 300.

The six changes that matter

1. AI-specific law is no longer just the EU AI Act (II.C)

Under v2.0.1, competency II.C focused on the EU AI Act. In v2.1 it covers AI-specific laws more broadly. Training providers that have reviewed the update point to South Korea's AI Basic Act and US federal and state laws affecting private-sector organisations as in scope. The question range rises from 5–7 to 6–8.

What to study: keep the EU AI Act as your anchor, because it's still the most detailed AI law and the one most questions are built around. Add a working knowledge of the structure of other AI laws: who they cover, what they require, and how they're enforced. Useful starting points are our explainers on South Korea's AI Basic Act, Texas TRAIGA, California's AI rules and NYC Local Law 144.

2. ISO/IEC 42005 added; standards questions reduced (II.D)

Performance indicator II.D.3 now refers to ISO/IEC 42005, the standard for AI system impact assessment. It sits alongside ISO/IEC 42001 (AI management systems). The reference to NIST's ARIA evaluation program was removed. Overall, II.D drops from 4–6 questions to 3–5.

What to study: know what each standard is for. 42001 sets out how an organisation runs an AI management system. 42005 sets out how to assess the impact of a specific AI system on individuals and society. Expect questions that ask which standard fits a situation. See ISO/IEC 42001 explained.

3. Agentic AI architectures (IV.A.3)

A new indicator in Domain IV covers agentic architectures: AI systems that plan and take actions, call tools or act on other systems with limited human input. This reflects how organisations now deploy AI.

What to study: the governance controls that change when AI can act, such as permission scoping, human approval for high-impact actions, logging, rollback, and monitoring for unexpected tool use.

4. "AI system" alongside "AI model"

Several items, including I.C.1 and competencies III.A–III.C and IV.A–IV.C, now refer to AI systems as well as AI models. The change looks small but it matters. A model is one component. A system includes the model plus data pipelines, interfaces, human processes and integrations. Many governance failures happen at system level, even when the model itself performs well.

5. New indicators in Domains I and II

New performance indicators were added at I.C.2, I.C.3, II.A.1 and II.A.3, broadening coverage of governance foundations and of how existing law, including privacy law, applies to AI.

6. Two indicators removed (III.A.3 and IV.B.2)

These were removed. Reviewers note this is probably not a substantive cut, because the content of which laws apply is now handled in Domain II.

The EU AI Act timeline you should know for 2026

Although the BoK changed in February, the EU AI Act itself was amended later in 2026 by the Digital Omnibus on AI (Regulation (EU) 2026/1744), published in the Official Journal on 24 July 2026. Know the current dates:

The exam tests concepts more than dates, but questions about obligations and roles assume you understand this structure.

How to update your study plan for v2.1

1. Reweight Domain II. Keep the EU AI Act at the centre and add one study session on other AI-specific laws and their common patterns: risk-based scope, transparency duties, impact assessments and enforcement.
2. Add a standards comparison. One page comparing the NIST AI RMF, ISO/IEC 42001 and ISO/IEC 42005: purpose, structure and who uses each.
3. Practise system-level scenarios. For each Domain III/IV question, ask what could fail outside the model itself, such as data feeds, user interfaces, integrations or human review.
4. Prepare for agentic AI questions. Learn the controls for AI that acts: least privilege, human-in-the-loop gates, audit trails and kill switches.
5. Retire old material. Discard question sets that mention the NIST ARIA program as a tested standard, or that treat II.C as purely EU.

For time allocation by domain, see our AIGP domain weights guide.

A quick checklist for v2.1-ready study materials

• Do they cover AI-specific laws beyond the EU AI Act, such as South Korea's AI Basic Act and US state laws?
• Do they mention ISO/IEC 42005 for AI impact assessment?
• Do they include agentic AI architectures and their controls?
• Do they use current EU AI Act dates after the Digital Omnibus (for example, Annex III high-risk from 2 December 2027)?
• Have they dropped the NIST ARIA reference and the two removed indicators?

If the answer to most of these is no, use the materials for background only and check every topic against the official BoK.

Frequently asked questions

Sources

1. IAPP: AIGP Body of Knowledge (PDF)
2. Privacy Bootcamp: AIGP Body of Knowledge 2026 (summary of v2.1 changes)
3. Gibson Dunn: EU AI Act Omnibus Agreement
4. Regulation (EU) 2024/1689 (EU AI Act), EUR-Lex

Last reviewed: October 2026. Always download the current BoK from IAPP before you start studying, because IAPP publishes updates in advance of their effective dates.