Last updated:
ISACA AI certifications: what each covers, and which your current credential opens
ISACA offers three AI certifications you can sit now: AAIA for AI audit (launched May 2025), AAISM for AI security management (August 2025) and AAIR for AI risk (April 2026). A fourth, AAIG for AI governance, is in a beta that is closed to new applicants. Each of the three open exams builds on a credential you already hold: CISA holders can sit AAIA and AAIR, CISM and CISSP holders AAISM and AAIR, and CRISC, CGEIT and CDPSE holders AAIR. All three are 90 questions in 150 minutes, priced at US$459 for ISACA members and US$599 for non-members.
Which one your current credential opens
Find the credential you hold in the left column. The right column lists every ISACA AI certification it qualifies you for today; each qualifying credential opens one or two of them.
| You hold | Open to you now |
|---|---|
| CISA | AAIA and AAIR |
| CISM | AAISM and AAIR |
| CISSP | AAISM and AAIR |
| CRISC or CDPSE | AAIR |
| CGEIT | AAIR |
| CIA, US CPA, ACCA or another listed audit or accounting designation | AAIA (with an IT audit or IT advisory role) and AAIR |
| PMI-RMP, CGRC or another listed risk designation | AAIR |
Most audit and accounting designations are on both lists: CIA, US CPA, Canadian CPA, ACCA and FCCA, Japanese CPA, ICAEW, ANAN, CA ANZ and Hong Kong CPA. Two are on one list only: CPA Australia opens AAIA but not AAIR, and CGMA opens AAIR but not AAIA. AAIA asks these holders for an IT audit or IT advisory role; AAIR sets no role condition.
AAIR's list also includes risk and compliance credentials such as CRMP, CRMA, CERP, CRCM and PMI-RMP. CGEIT holders were also eligible for the AAIG beta, which no longer takes applications. Check your exact designation on ISACA's page for the exam before you register.
ISACA's AI certifications at a glance
| Credential | Status and who it is for |
|---|---|
| AAIA, Advanced in AI Audit | Launched 19 May 2025. For auditors of AI systems. Domains: AI Governance and Risk; AI Operations; AI Auditing Tools and Techniques. |
| AAISM, Advanced in AI Security Management | Launched 19 August 2025. For security managers of AI systems. Domains: AI Governance and Program Management; AI Risk Management; AI Technologies and Controls. |
| AAIR, Advanced in AI Risk | Launched 15 April 2026. For risk professionals. Domains: AI Risk Governance and Framework Integration; AI Life Cycle Risk Management; AI Risk Program Management. |
| AAIG, Advanced in AI Governance | Beta in progress; the application period is closed. For enterprise AI governance. No exam details published yet. |
What the three open exams share
AAIA, AAISM and AAIR use one exam shape: 90 questions in 150 minutes, each with one best answer and no penalty for a wrong one. Each exam costs US$459 for ISACA members and US$599 for non-members, and after you pass you pay a US$50 application fee. You can sit at a PSI test centre or with remote proctoring, except in India, mainland China and Hong Kong, where ISACA offers these exams at test centres only.
To stay certified you report 10 CPE hours a year and 30 every three years. ISACA's AAISM and AAIA pages charge US$20 a year for members or US$35 for non-members and say that amount is your total for all the Advanced credentials you hold. ISACA's AAIR page lists its own fee, US$45 a year for members or US$85 for non-members, falling to US$25 or US$50 once you hold more than two ISACA certifications. If you plan to hold AAIR alongside AAIA or AAISM, confirm with ISACA how the fees combine. Your CISA, CISM or other base credential keeps its own fees.
When your credential opens two
If your credential opens two, pick the one that matches the work you do. ISACA does not publish pass rates for any of them on its exam pages or candidate guides, so there is no difficulty ranking to go by.
Roughly: AAISM fits you if you decide which controls an AI system needs, AAIA if you test those controls and report on them, and AAIR if you judge AI risk against what the organisation will accept. The comparison guide goes domain by domain:
ISACA AI certification timeline
- 19 May 2025: ISACA launches AAIA, open at first to holders of an active CISA, CIA or CPA. (ISACA)
- 22 July 2025: AAIA eligibility widens to six more accounting credentials, including ACCA, Canadian CPA and Japanese CPA. (ISACA)
- 19 August 2025: ISACA launches AAISM, for holders of an active CISM or CISSP. (ISACA)
- 15 April 2026: ISACA launches AAIR, for IT risk and advisory professionals who hold one of ISACA's listed credentials. (ISACA)
- As of 2 November 2026: AAIG is in beta. ISACA has closed beta applications and has not given a launch date. (ISACA)
AAIR in brief
AAIR is ISACA's AI risk credential and the newest of the three you can sit. It accepts the widest list: the ISACA certifications CISA, CISM, CRISC, CGEIT and CDPSE, plus CISSP, CIA, CGRC, PMI-RMP and other risk, audit and accounting designations named on ISACA's AAIR page. ISACA's launch release also describes candidates as having proven experience in IT risk or advisory roles.
AAIR's candidate guide sets out three domains: AI Risk Governance and Framework Integration 37%, AI Life Cycle Risk Management 21% and AI Risk Program Management 42%. The exam is offered in English, Spanish and Chinese.
ISACA's free five-question AAIR quiz is set, in ISACA's words, at the same level of difficulty as the exam, so it is a quick way to see the question style before you register.
AAIG: what ISACA has published so far
AAIG, Advanced in AI Governance, is ISACA's fourth AI credential and the only one not yet open to everyone who qualifies. Its beta is running, and new beta applications have closed.
Beta candidates needed an active CGEIT, or six years of enterprise governance work with at least one of those years in AI. ISACA lists three practice areas: AI Enterprise Governance, Data and AI Architecture Principles, and AI Enterprise Integration and Performance Monitoring.
ISACA has not published an exam format, fee or launch date for AAIG, and its prep products are marked coming soon. If AI governance is your work, AAIR's first domain, AI Risk Governance and Framework Integration, is the nearest open option; watch ISACA's AAIG page for the full launch.
Practising with your own data
CertArc offers practice for AAISM and AAIA. Each starts with a free baseline, and your results show which domain to study first.
As you practise you choose Confident, Unsure or Guess before each answer is revealed, so your results show which domains are solid and which right answers were guesses. CertArc does not offer AAIR or AAIG practice.
Where to go next
- AAISM vs AAIA vs AAIR: domain weights, overlap and languages side by side.
- AAISM exam preparation: the AAISM guides and the free diagnostic.
- AAIA exam preparation: the AAIA guides and free practice questions.
- How hard is the AAISM exam?: what ISACA says, for CISM and CISSP holders.
- How hard is the AAIA exam?: what ISACA says, for CISA holders and auditors.
- AAISM cost: exam, application, maintenance and membership fees in full.
Questions about ISACA's AI certifications
How many AI certifications does ISACA offer?
Three you can sit now, AAIA, AAISM and AAIR, and a fourth, AAIG, in a beta that is closed to new applicants (checked 2 November 2026).
Which ISACA AI certification is best?
It depends on your work and the credential you hold. Your credential decides which you can sit; the decisions you make about AI decide which fits. ISACA does not publish pass rates for any of them.
Can I get an ISACA AI certification without CISM or CISA?
Yes. AAIR accepts CISSP, CIA, CGRC, PMI-RMP and other listed designations. AAISM needs CISM or CISSP, and AAIA needs CISA or a listed audit or accounting designation with an IT audit or IT advisory role.
Do I need one ISACA AI certification before another?
No. Each depends on the credential you already hold, not on another AI credential.
How much do ISACA's AI certifications cost?
Each exam costs US$459 for ISACA members and US$599 for non-members, plus US$50 to apply once you pass. To keep them, ISACA's AAISM and AAIA pages charge US$20 a year for members or US$35 for non-members for all your Advanced credentials, and its AAIR page lists US$45 a year for members or US$85 for non-members.
Can I take an ISACA AI exam online?
Yes, with remote proctoring, or at a PSI test centre. Residents of India, mainland China and Hong Kong take AAIA, AAISM and AAIR at a test centre only.
Is AAIG available?
Not yet. It is in beta, the application period is closed, and ISACA has not published a launch date.
Does CertArc offer practice for all of them?
CertArc offers AAISM and AAIA practice, each with a free baseline. It does not offer AAIR or AAIG practice.
Sources
ISACA pages, candidate guides and press releases, checked on 2 November 2026:
- ISACA certifications list (AAIA, AAISM, AAIR and AAIG beta)
- ISACA press release launching AAIA (May 2025)
- ISACA press release expanding AAIA eligibility (July 2025)
- ISACA AAIA certification requirements
- ISACA AAIA certification page
- ISACA press release introducing AAISM (August 2025)
- ISACA AAISM certification page
- ISACA AAISM maintenance requirements
- ISACA press release launching AAIR (April 2026)
- ISACA AAIR certification page
- ISACA AAIR Exam Candidate Guide
- ISACA AAIR free practice quiz
- ISACA AAIR maintenance requirements
- ISACA AAIG certification page (beta)
CertArc is independent and is not affiliated with or endorsed by ISACA. Practice results do not convert to an official score or predict a result.