You are ready to book the AIGP if you can explain, without notes: the four BoK v2.1 domains, EU AI Act risk categories including the GPAI tier under the Digital Omnibus, the NIST AI RMF's govern-map-measure-manage structure, and at least three substantive differences between the EU and US regulatory approaches. If any of those feel shaky, you are not ready yet — but you probably know what to study. This checklist tells you where.
Booking the AIGP exam at $649 member or $799 non-member is not a decision to make casually. A failed sitting costs you the fee, the preparation time already spent, and a 30-day waiting period before you can retest. Before you book, use this diagnostic to confirm you are actually ready — not just "feeling ready".
The checklist below maps to AIGP BoK v2.1, the current version of the Body of Knowledge covering the EU AI Act, the Digital Omnibus package, Regulation 2026/1744, the NIST AI Risk Management Framework, and the OECD AI Principles. If a term in the list is unfamiliar, that is itself a readiness signal: you have work to do before booking.
Domain I — Understanding the AI Governance Landscape
Can you explain, without notes:
- The historical arc from AI ethics principles to binding AI regulation, including the OECD AI Principles (2019), the UNESCO Recommendation (2021), and the EU AI Act timeline
- The difference between AI "ethics" (principles-based, voluntary) and AI "governance" (control-based, enforceable)
- Why machine learning fundamentals matter for a governance role — bias amplification, model drift, training data provenance, foundation vs fine-tuned models
- The core actors in AI governance: regulators, providers, deployers, affected persons
- At least three major AI incidents that shaped current regulation (e.g. COMPAS, Clearview AI, Dutch SyRI, Italian ChatGPT ban)
If you cannot run through most of these from memory in a few sentences each, Domain I is weak. It is the smallest domain by exam weight but foundational — gaps here cascade into Domains II–IV.
Most AIGP candidates are closer to passing than they think.
The gap is usually smaller than it feels. What closes it is how you practice, not how much.
Get the Complete Pack →Domain II — AI Governance Frameworks and Regulations
Domain II is the heaviest domain on the AIGP, estimated at around 30% of your score. It covers the EU AI Act in detail plus the NIST AI RMF and comparative regulatory approaches globally.
EU AI Act readiness check:
- Four risk categories: unacceptable (prohibited), high-risk, limited-risk (transparency), minimal-risk
- Specific prohibited practices under Article 5 (social scoring, real-time biometric ID in public spaces with exceptions, emotion recognition in workplaces/schools)
- High-risk AI system obligations: risk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11), transparency (Art. 13), human oversight (Art. 14), accuracy/robustness (Art. 15)
- GPAI (general-purpose AI) model obligations under the Digital Omnibus package, including the systemic-risk threshold and the Code of Practice
- Governance structure: AI Office, European Artificial Intelligence Board, national supervisory authorities, notified bodies
- Enforcement timeline and penalty tiers (up to 7% global turnover for prohibited practices)
NIST AI RMF readiness check:
- The four functions: GOVERN, MAP, MEASURE, MANAGE
- How the RMF is structured as a voluntary framework and why that matters for the EU–US comparison
- Trustworthy AI characteristics: valid and reliable, safe, secure and resilient, accountable and transparent, explainable and interpretable, privacy-enhanced, fair with harmful bias managed
- Generative AI Profile (NIST AI 600-1) risks: confabulation, dangerous content, data privacy, environmental, human-AI configuration, information integrity, information security, intellectual property, obscene content, value chain and component integration
Comparative frameworks readiness check:
- UK pro-innovation approach and the role of regulators under existing powers
- US regulatory landscape: Executive Orders, state AI laws (Colorado AI Act, California SB-942, Illinois BIPA relevance), FTC enforcement, EEOC guidance
- Canada's AIDA, Singapore's Model AI Governance Framework, China's algorithmic regulation
- Sector regulators' AI positions: EU DPAs on GDPR + AI, financial regulators on algorithmic trading, healthcare regulators on medical AI
Domain III — The AI Development Lifecycle
Domain III tests whether you understand AI governance operationally — not just the regulations, but how they land on an AI programme in practice.
Lifecycle readiness check:
- The AI lifecycle stages: planning, data collection, model development, testing, deployment, monitoring, decommissioning
- Governance activities at each stage: impact assessment, data governance, bias testing, red-teaming, post-market monitoring
- Fundamental Rights Impact Assessment (FRIA) requirements under the EU AI Act for public-sector deployers of high-risk AI
- How a Data Protection Impact Assessment (DPIA) and an AI impact assessment relate — overlapping but distinct instruments
- Documentation standards: model cards, system cards, data sheets, technical documentation under EU AI Act Annex IV
- Human oversight design: human-in-the-loop vs human-on-the-loop vs human-in-command
- Incident response under AI-specific obligations (serious incident reporting under EU AI Act Art. 73)
Domain IV — Implementing AI Governance in Practice
Domain IV turns the regulations into programme work: policies, roles, controls, metrics.
Programme implementation readiness check:
- How to structure an AI governance programme: policies, procedures, roles (chief AI officer, AI governance committee), training
- Risk assessment methodology for AI systems — probability and severity, likelihood scales, control effectiveness
- Vendor and third-party management for AI procurement: due diligence questions, contractual terms, ongoing monitoring
- Integration with existing governance: privacy, cybersecurity, data governance, model risk management, ethics
- Metrics for AI governance: fairness metrics, drift metrics, incident counts, time-to-remediation, FRIA coverage
- Communication: how to brief executives, how to disclose to regulators, how to inform affected persons
Score Yourself Honestly
For each of the four domains above, give yourself one of three ratings:
- Solid: I can explain every item without hesitation.
- Shaky: I know the terms but could not teach them.
- Unknown: Half of this list is new to me.
All four domains "Solid"
Book the exam. You are ready. Use the final two weeks for timed practice (the full 100-question mock) and targeted review of edge cases.
Two or three domains "Solid", the rest "Shaky"
Book the exam 4–5 weeks out. Spend the first two to three weeks closing the "Shaky" domains with the Cram Guide and question bank, then move to timed practice.
Any domain "Unknown"
Do not book yet. Spend two to three weeks with the Cram Guide to build the baseline, then re-run this checklist. The Archuz AIGP Cram Guide is structured around BoK v2.1 and takes most candidates about 15–20 hours of focused reading to work through once.
The Regulatory Currency Problem
One more readiness filter: the AIGP tests you on current regulation, which in 2026 means the EU AI Act as amended by the Digital Omnibus and Regulation 2026/1744. A lot of study material online is still written against the pre-Omnibus text, especially on the GPAI regime.
If your study materials do not explicitly reference the Digital Omnibus, the GPAI systemic-risk threshold, and the Code of Practice, they are out of date. The Archuz AIGP Cram Guide is maintained to BoK v2.1 and the current regulatory stack — if a provision changed in 2025 or 2026, the Cram Guide reflects it.
Frequently Asked Questions
How long is the AIGP exam?
The AIGP is 100 questions, 180 minutes (3 hours), scaled score 100–500, passing at 300. Questions are delivered in six formats including scenario, use case, ordering, multi-select, select-all-that-apply, and standard multiple choice.
How much does the AIGP exam cost?
$649 for IAPP members, $799 for non-members, and $475 for subsequent certifications added on top of an existing IAPP credential (CIPP, CIPM, CIPT).
What is the pass rate for the AIGP exam?
IAPP does not publish pass rates for individual sittings. Reports from candidates and training providers suggest the AIGP pass rate is in line with other IAPP exams — not punishingly low, but low enough that unprepared candidates fail regularly.
Can I take the AIGP online?
Yes. IAPP offers the AIGP through Pearson VUE, with both in-person testing centre and online proctored options. Online proctoring has strict environment and ID requirements.
What if I fail the AIGP?
You can retake the AIGP after a 30-day waiting period. The retake fee is the same as the original. Most candidates who fail do so because they underestimated Domain II (frameworks and regulations) — the fix is usually a targeted re-read of the Cram Guide section on EU AI Act obligations plus another timed practice mock.
Does the AIGP require continuing education credits?
Yes. AIGP holders must earn 20 CPE credits every two years to maintain the credential, similar to other IAPP certifications. CPE can come from IAPP events, qualifying webinars, teaching, publishing, or related activities.
Is AIGP recognised globally?
IAPP certifications are globally recognised in privacy and data protection; AIGP, being newer, is still building that recognition in AI-specific roles. In 2025–2026, AIGP has become the de facto reference credential for AI governance, risk, and compliance roles, particularly at firms with EU AI Act exposure.
What is the best study resource for the AIGP?
IAPP's own body of knowledge is the authoritative syllabus. For focused exam preparation, a dedicated AIGP Cram Guide (current to BoK v2.1) plus a 300-question question bank with full explanations is the most time-efficient path. The Archuz AIGP Complete Pack bundles both plus an After You Pass career guide for $180.