AIGP Domain Weights: How to Allocate Your Study Time by Exam Weight

The AIGP exam draws its 90 questions from five domains in proportion to their published weights. If you study each domain equally, you're misallocating your time — you're spending 20% of study hours on Domain 5 (which accounts for only 15% of the exam) and only 20% on Domain 2 (which accounts for 25% of the exam). Over 80 study hours, that's a 4-hour misallocation per domain — material at this level. This guide covers the domain weights, what each domain actually tests, a study hour allocation formula, and 5 practice questions representative of the domains where time allocation matters most.

AIGP Exam Domain Weights (BOK v2.1)

The allocation formula: Domain weight × Total study hours = Hours to allocate to that domain. Simple. The mistake most candidates make is not using it.

Domain 1: AI Technology Foundations (~20%)

Domain 1 establishes the technical literacy foundation that the rest of the AIGP builds on. This is not a deep technical domain — the AIGP is a governance certification, not an AI engineering certification. You need to understand AI concepts well enough to govern systems that use them, not to build them.

Core content:

• Types of AI systems: Narrow AI (task-specific) vs. General AI (hypothetical broad capability). Supervised, unsupervised, and reinforcement learning at a conceptual level. Neural networks, deep learning, large language models (LLMs) — what they are, not how to build them.
• AI system vs. GPAI model: A critical EU AI Act distinction. An AI system is designed to operate with a degree of autonomy and produce outputs (recommendations, decisions, predictions, content). A General Purpose AI (GPAI) model is a model trained on large data that can perform a wide range of tasks — the underlying model that AI systems may be built upon. The EU AI Act treats GPAI models (like foundation models) separately from AI systems.
• Data pipeline concepts: Training data, validation data, test data. Data quality dimensions: accuracy, completeness, consistency, timeliness. How training data quality affects model output quality.
• OECD AI Principles (2019): The five principles — Inclusive Growth and Well-Being; Human-Centred Values and Fairness; Transparency and Explainability; Robustness, Security and Safety; Accountability. These are the foundational international AI ethics principles referenced throughout the BOK.
• EU AI Act risk tiers: Unacceptable risk (prohibited); High risk (Annex III); Limited risk (transparency obligations); Minimal risk (no specific requirements). Know which tier each category falls into and why.

Common exam patterns in Domain 1: Scenario questions that test whether you can identify what type of AI system is described, which EU AI Act risk tier applies to a described use case, or which OECD principle is most relevant to a described situation.

Domain 2: AI Governance Program Design (~25% — Highest Weight)

Domain 2 is the largest domain and the one where candidates who've worked in privacy or risk management have the strongest advantage. It tests whether you can design an organizational AI governance program — the structures, policies, processes, and accountability mechanisms.

AI Governance Accountability Structure

The exam tests who owns AI governance in an organization. The correct answer is: the board and executive leadership own it, with day-to-day management delegated to a designated AI governance role (Chief AI Officer, AI Risk Officer, or similar). The key AIGP BOK principle: AI governance accountability cannot be effectively delegated entirely to a technical team. Business leaders who approve AI use cases must be accountable for governance outcomes.

What the exam tests on accountability:

• The distinction between responsibility (doing the work) and accountability (owning the outcome). An AI ethics team can be responsible for risk assessments; a business unit VP is accountable for the AI system deployed in their function.
• Who approves high-risk AI deployments? (Should require executive and governance committee sign-off, not just technical sign-off)
• How AI governance integrates with existing privacy, security, and risk frameworks — not as a separate silo but as an extension of existing enterprise risk management

AI Inventory and Risk Classification

An AI inventory is the foundational operational tool of an AI governance program — analogous to the ROPA in a privacy program. For the AIGP exam, know:

• What an AI inventory must capture: System name and description; business owner; intended purpose and use cases; data sources; vendor or build (internal vs. third-party); risk classification; current governance status (approved, under review, decommissioned)
• Risk classification criteria: Impact on individuals; scale of deployment; reversibility of decisions; use of sensitive data; degree of human oversight in the loop; regulatory classification under the EU AI Act
• Inventory maintenance triggers: New AI deployment; change in purpose or data inputs; change in vendor; regulatory reclassification; post-incident review
• The "shadow AI" problem: Employees deploying AI tools (generative AI, productivity AI) without organizational awareness or approval. Effective AI governance programs have a process for discovering and governing shadow AI use.

Third-Party AI Due Diligence

Many organizations procure AI systems from vendors rather than building them internally. Domain 2 tests whether you know the governance obligations that procurement creates:

• Pre-procurement: risk classification of the intended use; assessment of the vendor's AI governance and ethics practices; review of training data provenance claims
• Contractual protections: audit rights; incident notification obligations; change notification (if the model is updated); data use restrictions; indemnification for AI-caused harm
• Ongoing monitoring: post-deployment performance monitoring; ongoing vendor assessment; exit planning (what happens to the organization's data and dependencies if the vendor relationship ends?)

Domain 3: AI Risk Management (~22%)

Domain 3 covers the operational practice of identifying, assessing, and managing AI-specific risks. The NIST AI RMF is the primary framework tested in this domain, alongside FRIA, bias assessment, and model monitoring.

NIST AI RMF Functions — Deep Exam Detail

The four NIST AI RMF functions (Govern, Map, Measure, Manage) are tested in application, not just definition. The exam presents scenarios and asks which function is being performed or which function should be applied next.

Govern function — key exam content:

• Organizational policies and procedures for AI risk management
• Roles and responsibilities assignment for AI trustworthiness
• Culture of AI risk awareness and responsible development/deployment
• Governance is continuous — not a phase. It underpins Map, Measure, and Manage simultaneously.

Map function — key exam content:

• Context establishment: what is the intended use of the AI system? Who are the stakeholders?
• Risk identification: what could go wrong? Who could be harmed? What are the failure modes?
• AI system categorization: what type of system is it, what data does it use, what decisions does it support?
• Interdependencies: how does this AI system interact with other systems and processes?

Measure function — key exam content:

• Quantitative and qualitative risk evaluation: how likely is the risk, how severe are the impacts?
• Bias and fairness metrics: disparate impact rate, equal opportunity rate, demographic parity — what they measure and when each is appropriate
• Performance benchmarking: accuracy, precision, recall, F1 score — not deep statistics, but understanding what these metrics reveal about model performance
• Red teaming: structured adversarial testing of AI systems to discover failure modes before deployment

Manage function — key exam content:

• Risk treatment decisions: accept, mitigate, transfer, avoid
• Model monitoring: post-deployment performance tracking; detecting model drift (when model performance degrades because real-world data distribution has shifted from training data)
• Incident response: how to respond when an AI system produces a harmful output or fails in a way that affects individuals
• Model updates and retraining: governance process for when and how to update a deployed model

Domain 4: Laws and Regulations (~18%)

Domain 4 is consistently under-studied relative to its exam weight. Candidates who come from a governance or privacy background often assume they know the regulatory content — but the AIGP tests article-level precision on the EU AI Act that most candidates haven't drilled.

The EU AI Act provisions you must know at article level: Articles 5, 6, 9, 11, 13, 17, 26, 27, 43, 73, and 86. For each: know who it applies to (provider, deployer, or both) and what it specifically requires — not just that it exists.

Other frameworks with lower but real exam presence:

• OECD AI Principles: 5 recommendations (inclusive growth; human-centred values; transparency/explainability; robustness/security/safety; accountability) + 5 recommendations for governments (investing in AI R&D; fostering a digital ecosystem; enabling policy environment; capacity building; international cooperation)
• Singapore Model AI Governance Framework (2nd Ed.): Two pillars — Internal Governance and Stakeholder Management. Used in Domain 4 scenario questions as an example of national AI governance framework.
• ISO/IEC 42001:2023: AI management system standard. Know its purpose (AIMS certification), its positioning relative to EU AI Act (voluntary vs. regulatory), and who can be certified (organizations, not AI systems).

Domain 5: Ethics and Accountability (~15%)

Domain 5 is the smallest domain and covers the ethical principles that underpin the entire AI governance framework. For the exam, the primary risk is conflating definitions that sound similar.

5 Exam-Style AIGP Domain Weight Practice Questions

Frequently Asked Questions