Last updated:
AAISM preparation guide
AAISM vs AIGP: AI security management or AI governance?
Direct answer
AAISM and AIGP overlap on AI governance but start from different places. AAISM, from ISACA, is for active CISM or CISSP holders and tests how a security manager governs, assesses and controls AI systems; AI technologies and controls alone are 38% of the exam. AIGP, from IAPP, lists no prerequisite credential on its exam page and centres on responsible AI governance and how laws and frameworks apply across the AI life cycle.
The formats differ too. Some summaries give AIGP the same 90-question, 150-minute format as AAISM; IAPP lists AIGP as 100 questions in 2.75 hours.
CertArc is independent and not affiliated with ISACA or IAPP.
Start AAISM baselineAAISM and AIGP side by side (checked October 12, 2026)
| Topic | AAISM (ISACA) | AIGP (IAPP) |
|---|---|---|
| Prerequisite | Active CISM or CISSP | None listed on IAPP's AIGP exam page |
| Exam | 90 multiple-choice questions, 150 minutes | 100 questions, 2.75 hours plus a 15-minute break |
| Exam fee | US$459 members, US$599 non-members, plus US$50 application | US$649 members, US$799 non-members |
| Where | PSI test centres or remote proctoring; some regions are test-centre only | Pearson VUE test centres or online |
| Window | Sit within six months of registering | Take within one year of purchase |
| Keeping it | 10 CPE a year and 30 over three years; US$20 or US$35 a year; CISM or CISSP stays active | Two-year term with 20 CE credits; maintenance fee covered by IAPP membership, otherwise US$250 at recertification |
| Focus | AI governance and program management, AI risk management, AI technologies and controls | AI foundations and impacts, laws and frameworks, AI life cycle governance, emerging issues |
Original teaching example
A company plans to send customer complaints to a third-party language model for summaries, several complaints to a prompt, and the provider may keep prompts to train its models. Privacy counsel asks whether that sharing and retention is lawful under the company's notices. The security manager asks which controls keep one customer's details out of another's summary, and how outputs will be monitored.
AIGP puts more weight on the first question and AAISM on the second, though AAISM also covers regulatory requirements (1A) and privacy controls (3D). Choose the credential that matches most of the decisions you own.
Where the two overlap
Both cover AI governance and the AI life cycle.
AAISM adds security architecture, data controls and monitoring, at 38% of its exam. AIGP adds laws and frameworks and the wider impacts of AI.
Who should pick AAISM
Security managers and architects who hold CISM or CISSP and own controls for AI systems.
If you are asked to approve, secure or monitor an AI system, AAISM tests those decisions.
Who should pick AIGP
Privacy, legal, compliance and policy professionals who lead AI governance.
AIGP lists no prerequisite credential on its exam page, so it also suits people without a security certification.
Holding both
They come from different bodies with separate renewals.
Holding both makes sense when you lead AI governance across privacy and security.
Sources and fact check
Source checked: 2026-10-12
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Which is better for security professionals?
AAISM, if you hold CISM or CISSP and own security decisions for AI. AIGP suits privacy and policy-led roles.
Is AIGP easier because it has no prerequisite?
Neither body's pages publish data to compare difficulty.
How long are the exams?
AAISM is 90 questions in 150 minutes. AIGP is 100 questions in 2.75 hours plus a 15-minute break.
Can I hold both?
Yes. They are separate credentials with separate renewals.
Does CertArc offer AIGP practice?
No. CertArc offers AAISM practice and is independent of ISACA and IAPP.
