Under the EU AI Act, which category is subject to outright prohibition?
Domain II
Answer: B · whyUnacceptable-risk practices (e.g., social scoring) are banned; prohibitions applied from 2 Feb 2025.
IAPP (International Association of Privacy Professionals) · AI Governance
AIGP - Artificial Intelligence Governance Professional
Privacy, legal, compliance, risk and GRC professionals, product and data leaders responsible for governing how AI is developed, deployed and used.
Overview
- Prerequisites
- No experience prerequisite is listed by IAPP for the exam (verify on the official site). After passing you must hold an IAPP membership or pay the certification maintenance fee for the certification to be valid.
- Maintenance
- 2-year certification term. Submit 20 CPE credits that map to the AIGP BoK each term, and either keep an IAPP membership (US$295/year) or pay the US$250 certification maintenance fee per term.
- Outline in effect
- 2 Feb 2026
Exam facts
- Questions
- 100
- Duration
- 2.75 hours (2 h 45 min) with an optional 15-minute break
- Question types
- Multiple choice, some scenario-based and multi-select (no partial credit); includes unscored pilot items
- Passing score
- 300 on a 100-500 scale (not 60%)
- Format
- Linear, computer-based
- Delivery
- Pearson VUE test centres or online via OnVUE; must be taken within 1 year of purchase
- Languages
- English
Cost
- Member
- US$649
- Non-member
- US$799
- Notes
- IAPP store prices. Discounted retakes and discounts for existing IAPP certification holders are available (see store). Non-member price includes the first certification maintenance fee.
Domains & weights
- Domain I - Understanding the foundations of AI governance16–20 questions
- Domain II - Understanding how laws, standards and frameworks apply to AI19–23 questions
- Domain III - Understanding how to govern AI development21–25 questions
- Domain IV - Understanding how to govern AI deployment and use21–25 questions
Upcoming changes
Body of Knowledge v2.1, effective 2 Feb 2026 (approved 9 Sep 2025; supersedes v2.0.1). IAPP reviews the BoK annually. The blueprint gives a min-max number of questions per domain rather than percentages.
- IAPP reviews the AIGP BoK every year; check for a new version before booking.
Study plan
- Week 1
BoK + foundations
- Download BoK v2.1 and blueprint; read IAPP's Key Terms for AI Governance.
- AI types (ML, deep learning, generative AI, agents), AI harms, responsible AI principles (OECD).
- Week 2
Domain I
- Building an AI governance programme: roles, policies, inventory, risk tiers, cross-functional committees, training.
- Week 3
Domain II - existing laws
- How privacy (GDPR, DPDP Act), consumer protection, IP, anti-discrimination and product liability apply to AI.
- Week 4
Domain II - AI-specific laws and standards
- EU AI Act risk categories, obligations and timeline (incl. AI Omnibus changes), NIST AI RMF 1.0 and AI 600-1, ISO/IEC 42001 and 42005.
- Week 5
Domain III
- Governing design, data, training, testing and validation; documentation (model cards, data sheets); impact assessments; release readiness.
- Week 6
Domain IV
- Deployment decisions, vendor/third-party AI, licensing, monitoring, incident management, decommissioning.
- Week 7
Practice
- IAPP official practice exam; review explanations against the BoK.
- Week 8
Review
- Re-read weakest domain; scenario drills; book the exam.
Exam tips
- IAPP says to plan at least 30 hours of study; nothing outside the BoK is tested.
- Multi-select questions tell you how many answers to pick - you must get all of them right.
- Use the section breakdown on your result to target weak domains if you need a retake.
Common pitfalls
- Relying on older EU AI Act timelines - high-risk dates moved to 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) under the AI Omnibus.
- Studying only the law and skipping development/deployment governance (Domains III-IV are about half the exam).
- Assuming the passing score is 60%.
Resources & official links
Official
- AIGP Body of Knowledge and Exam Blueprint v2.1 (PDF)
- IAPP AIGP page and candidate handbook
- IAPP AIGP Online Training and Practice Exam (store)
- IAPP Certification FAQs
Also widely used
- EU AI Act text and Commission guidance (AI Act Service Desk)
- NIST AI RMF 1.0 and Generative AI Profile (AI 600-1)
- OECD AI Principles
- ISO/IEC 42001:2023
Sources
- IAPP AIGP page
- IAPP store: AIGP exam (price, 100 questions, 2.75 h, maintenance)
- IAPP Certification FAQs (scoring 100-500, pass 300, CMF US$250, membership US$295)
- AIGP BoK v2.1 effective 2 Feb 2026 (PDF)
Last verified 19 Oct 2026. Values marked “check official site” could not be confirmed from an official source.
Practice questions
Following the AI Omnibus, from when do high-risk obligations for Annex III use cases apply?
Domain II
Answer: C · whyRegulation (EU) 2026/1744 moved Annex III high-risk rules to 2 Dec 2027 (Annex I products: 2 Aug 2028).
Which NIST document is a companion profile for generative AI risks?
Domain II
Answer: B · whyNIST AI 600-1 (July 2024) is the Generative AI Profile of the AI RMF.
The four functions of the NIST AI RMF core are:
Domain II
Answer: B · whyAI RMF core functions are Govern, Map, Measure and Manage.
What is the FIRST step in building an AI governance programme?
Domain I
Answer: B · whyYou cannot govern AI you do not know about; inventory and accountability come first.
A model card is primarily used to:
Domain III
Answer: B · whyModel cards support transparency and informed deployment decisions.
Which activity BEST detects model drift after deployment?
Domain IV
Answer: B · whyDrift appears over time, so ongoing monitoring is needed.
When procuring a third-party AI system, which contract term is MOST important for governance?
Domain IV
Answer: B · whyContracts should secure transparency, data protections and incident cooperation.
Using personal data to train a model in the EU requires, among other things:
Domain II
Answer: B · whyGDPR continues to apply to AI training on personal data.
Which practice reduces the risk of discriminatory outcomes in an AI hiring tool?
Domain III
Answer: B · whyBias evaluation and meaningful human oversight are core controls.
A red-team exercise for a generative AI chatbot mainly aims to:
Domain III
Answer: B · whyAdversarial testing surfaces safety and security failures.
Who should approve the deployment of a high-impact AI system?
Domain IV
Answer: B · whyGovernance assigns approval to accountable roles after review.