AIGP Domain II (AI Governance Frameworks and Regulations) carries roughly 30% of the exam. Three frameworks dominate: the EU AI Act (as amended by the Digital Omnibus and Regulation 2026/1744), the NIST AI Risk Management Framework, and the OECD AI Principles. If you cannot explain EU AI Act risk categories, GPAI obligations, and NIST AI RMF's govern-map-measure-manage structure from memory, you are not ready for Domain II.
Of the four AIGP domains, Domain II is the one that most reliably decides pass or fail. It is the largest, the most fact-dense, and the fastest-moving — the regulatory landscape in 2025–2026 shifted enough that study material written even 18 months ago has stale sections.
This guide walks through what Domain II actually covers, in the order you should study it, with the specific provisions and framework elements that generate exam questions.
Why Domain II Is So Heavily Weighted
AIGP exists because organisations need people who can translate the regulatory landscape into operational AI governance. Domain II is where that translation lives. The exam cannot test your judgment on applying regulation if you do not first demonstrate you know the regulation. So Domain II comes first in weight.
Within Domain II, the EU AI Act is the heaviest sub-topic. If you have 20 hours to spend on Domain II, roughly 10 should go to the EU AI Act, 4–5 to the NIST AI RMF, 2–3 to OECD/UNESCO principles, and the remainder to comparative frameworks (UK, US state laws, Canada, Singapore).
The EU AI Act — What the Exam Actually Tests
Memorising every article of the EU AI Act is both impossible and unnecessary. The exam tests specific structural knowledge: risk categories, high-risk obligations, GPAI tier, governance institutions, and penalty structure.
Risk Categories
GPAI Models Under the Digital Omnibus
GPAI (general-purpose AI) is the EU AI Act's regime for foundation models. The Digital Omnibus package refined the GPAI obligations and set the systemic-risk threshold.
- All GPAI providers: technical documentation for the model, information for downstream providers, policy to respect EU copyright, publicly available summary of training content.
- Systemic-risk GPAI providers (models trained with over 10^25 FLOPs, or otherwise designated): additional obligations — model evaluation, systemic risk assessment and mitigation, serious incident reporting, cybersecurity protection.
- Code of Practice: voluntary mechanism for GPAI providers to demonstrate compliance; co-developed with the AI Office.
Governance Institutions
Four names you must know:
- AI Office — European Commission body supervising GPAI compliance across the EU
- European Artificial Intelligence Board — representatives from member states, advises the Commission
- National supervisory authorities — member-state regulators enforcing most of the AI Act
- Notified bodies — third-party conformity assessment bodies for high-risk AI
Penalties
- Up to 7% of global turnover (or €35M, whichever higher) for prohibited practices
- Up to 3% of global turnover (or €15M) for most other breaches
- Up to 1% of global turnover (or €7.5M) for supplying incorrect information to authorities
Deepfakes are in AIGP Domain II. Skipping it costs you points.
Niche legislation appears as scenario questions, not definitions. Most candidates underestimate it.
Get the Complete Pack →NIST AI Risk Management Framework
The NIST AI RMF is voluntary, process-oriented, and the US counterweight to the EU's rules-based approach. The exam tests structural understanding, not implementation detail.
GOVERN
Establishes a culture of AI risk management across the organisation. Covers policies, roles, accountability, risk tolerance, and integration with enterprise risk. The cross-cutting function that enables the other three.
MAP
Establishes the context of an AI system — its purpose, stakeholders, operational environment, and the risks it generates. Produces a risk profile that MEASURE and MANAGE then act on.
MEASURE
Analyses, assesses, benchmarks, and monitors AI risks. Covers testing, evaluation, metrics, and ongoing monitoring. Produces evidence for the MANAGE function.
MANAGE
Allocates risk resources, prioritises risks, implements controls, and responds to incidents. The function that takes action on the risks mapped and measured.
Trustworthy AI Characteristics
NIST's seven characteristics of trustworthy AI are high-value exam content. Know all seven and what each means:
- Valid and reliable — accurate and consistent in intended use
- Safe — does not cause physical or psychological harm
- Secure and resilient — withstands attacks and adverse conditions
- Accountable and transparent — clear responsibility, traceable decisions
- Explainable and interpretable — outputs can be understood
- Privacy-enhanced — respects data protection principles
- Fair with harmful bias managed — equitable outcomes, bias monitored and mitigated
Generative AI Profile (NIST AI 600-1)
NIST's Generative AI Profile adds twelve risk categories specific to generative AI. Candidates often skip this. The exam does not.
- Chemical, biological, radiological, nuclear information or capabilities
- Confabulation
- Dangerous, violent, or hateful content
- Data privacy
- Environmental impacts
- Harmful bias and homogenisation
- Human-AI configuration
- Information integrity
- Information security
- Intellectual property
- Obscene, degrading, abusive content
- Value chain and component integration
OECD AI Principles and UNESCO Recommendation
Both are soft-law instruments but foundational to the current regulatory stack. Exam questions test whether you can identify them and distinguish them from binding regulation.
OECD AI Principles (2019, updated 2024)
- Inclusive growth, sustainable development, and well-being
- Human rights and democratic values, including fairness and privacy
- Transparency and explainability
- Robustness, security, and safety
- Accountability
Plus five recommendations for governments on investing in AI R&D, fostering an inclusive AI ecosystem, shaping policy, building human capacity, and international cooperation.
UNESCO Recommendation (2021)
First global standard-setting instrument on AI ethics. Non-binding but widely referenced. Emphasises human rights, environmental sustainability, cultural diversity, and gender equality. 193 member states adopted.
Comparative Frameworks
United States
- Executive Orders on AI (2023 and successors) — directs federal agencies on AI risk, standards, and workforce
- Colorado AI Act (SB 24-205) — first comprehensive US state AI law, high-risk AI focus, effective Feb 2026
- California SB-942 (AI Transparency Act), AB-2013 (training data transparency)
- FTC enforcement under existing authorities (unfair/deceptive practices, Section 5)
- EEOC guidance on AI in employment decisions
United Kingdom
- Pro-innovation approach via existing regulators (ICO, FCA, CMA, MHRA) rather than a single AI act
- Five cross-sectoral principles: safety, transparency, fairness, accountability, contestability
- AI Safety Institute focused on frontier model risks
Canada, Singapore, China, Brazil
- Canada: AIDA (Artificial Intelligence and Data Act) pending; voluntary code for GPAI
- Singapore: Model AI Governance Framework (voluntary), AI Verify toolkit
- China: algorithmic recommendation regulation, deep synthesis regulation, generative AI measures
- Brazil: AI Bill (PL 2338/2023) in advanced stages
Deepfakes are in AIGP Domain II. Skipping it costs you points.
Niche legislation appears as scenario questions, not definitions. Most candidates underestimate it.
Get the Complete Pack →How to Study Domain II Efficiently
Three weeks is realistic for Domain II alone if you are starting from scratch:
- Week 1: EU AI Act in depth — read the Cram Guide chapter, then do 40–50 EU AI Act-focused practice questions with explanations.
- Week 2: NIST AI RMF and OECD/UNESCO — build the structural map, then compare across frameworks. Comparison questions appear regularly.
- Week 3: Comparative frameworks and consolidation — US state laws, UK approach, Canada/Singapore/China, then full-domain practice questions.
The Archuz AIGP Cram Guide dedicates its longest chapter to Domain II, with every element above covered to exam depth. The question bank includes format-mixed practice specifically for Domain II so you drill scenario, ordering, and select-all-that-apply questions in the hardest domain.
Frequently Asked Questions
What percentage of AIGP questions come from Domain II?
IAPP does not publish exact per-domain question counts. Based on the published BoK weighting and candidate reports, Domain II accounts for roughly 30% of the AIGP, making it the single heaviest domain.
Do I need to memorise every EU AI Act article?
No. You need to know the structure, the risk categories, the high-risk obligations under Articles 9–15, the GPAI regime, the governance institutions, and the penalty tiers. Specific article numbers help for the hardest scenario questions, but the exam does not test rote memorisation of article headings.
Is the EU AI Act Digital Omnibus already on the AIGP?
Yes. AIGP BoK v2.1 incorporates the Digital Omnibus package and Regulation 2026/1744. Study materials dated before mid-2025 do not reflect this and are no longer current.
How is the NIST AI RMF tested on AIGP?
Primarily on structural knowledge: the four functions (govern, map, measure, manage), the seven trustworthy AI characteristics, and the Generative AI Profile risk categories. Scenario questions ask you to identify which NIST function a described activity falls under.
What is the difference between a provider and a deployer under the EU AI Act?
A provider develops or markets an AI system. A deployer uses an AI system under their authority (except for personal, non-professional use). Obligations differ significantly — providers carry the heavier compliance load, deployers have narrower but important duties around oversight, logging, and informing affected persons.
Are US state AI laws tested on AIGP?
Yes, especially the Colorado AI Act as the first comprehensive US state AI law. Expect at least one or two questions touching on US state AI regulation and its contrast with the federal approach.
How much time should I spend on Domain II relative to the other domains?
Roughly 40% of your Domain II–IV study time, given its exam weight. Domain I is foundational but light. Domains III and IV are operational and share a lot of practical content, so they study faster once you have Domain II under control.
What is a scenario question in AIGP Domain II?
A scenario question gives you a short fact pattern — an organisation, a use case, a jurisdiction — and asks several questions about how the regulation applies. These are heavier in Domain II than elsewhere because the regulatory stack is dense enough to generate rich scenarios.