AIGP vs CIPP/CIPM: which should you take first?
AIGP and the IAPP's privacy family test different things: AIGP is about AI systems broadly, CIPP/CIPM/CIPT are about personal data specifically. Same certifying body, same exam scale, different subject and different depth.
Studying for the AIGP? Create a free account to practise Domain I questions with explanations and track your progress. No card details.
Create a free accountWhat each credential actually covers
- CIPP/E — European data protection law: the GDPR and the regulatory landscape around it. Jurisdiction-specific.
- CIPP/US — the US privacy law patchwork: sectoral federal law plus the growing set of state statutes. Jurisdiction-specific.
- CIPM — privacy programme management: building and running a privacy office, independent of which jurisdiction's law applies.
- CIPT — privacy engineering: building privacy into systems and technology. The closest of the three to a technical credential.
- AIGP — AI governance across four domains: AI foundations, the surrounding law and standards (data protection among them, not only it), and the operational governance of AI systems through development and deployment. Broader subject, less depth in any one law.
Same exam house, different scale
| CIPP/E, CIPP/US, CIPM, CIPT | AIGP | |
|---|---|---|
| Format | 90 questions (75 scored, 15 unscored), 2.5 hours | 100 questions, 3 hours |
| Scoring | Scaled 100–500, pass at 300 | Scaled 100–500, pass at 300 |
| Fee, first IAPP certification | $550 | $799 ($649 IAPP members) |
| Fee, already hold an IAPP certification | $375 (retake or additional CIPP-family exam) | No published discount found for AIGP specifically — plan for full price |
The two families share a certifying body, a scoring scale and a pass mark. They do not share a discount: the IAPP's reduced $375 fee for holders of an existing certification is documented for the CIPP/US, CIPP/E, CIPP/C, CIPM and CIPT exams. Nothing published extends that rate to the AIGP, so budget for it at full price even after passing a CIPP. Fees are the IAPP's published prices — confirm at iapp.org before booking. Full detail on the AIGP's own costs and retake fees is in the AIGP exam guide.
Is the AIGP harder than a CIPP?
They are hard in different ways. The CIPP/E goes deep into one legal regime; the AIGP is broader — law, frameworks, technology and operations — with less depth in any one part. Candidates with privacy certifications usually find the AIGP's legal material familiar and its technical material new: how models are built, tested and monitored is on the AIGP paper and on none of the privacy ones. Coming the other way, a technical candidate finds the AIGP's legal domain the work, and a CIPP entirely new ground.
No pass rate settles the question, because the IAPP does not publish pass rates for any of these exams. The comparative figures circulating online (typically 45–55% first-attempt for the AIGP against 50–70% for the CIPP family) are third-party estimates with no published methodology, so they cannot carry the comparison. What is published is the format above: the AIGP paper is ten questions longer, half an hour longer, and scored on the same scale with the same pass mark. Where the difficulty lives on the AIGP specifically is covered at how hard is the AIGP exam.
Which should you take first?
If your work is primarily privacy law in one jurisdiction, start there — CIPP/E for Europe, CIPP/US for the United States, CIPM if the job is running a privacy programme rather than the law itself. If your work is already AI governance, or your organisation is facing the EU AI Act now, there is no requirement to hold a privacy credential first: the AIGP stands alone. Holding a CIPP first is a genuine head start on AIGP's law-and-standards domain, not a requirement for it.
Doing more than one
Plenty of privacy professionals end up holding two or more of these over a career — a CIPP for the law, a CIPM for the programme, an AIGP once AI governance lands on their desk too. There is no required order beyond what your current job needs first; each stands on its own, and none substitutes for another.
Frequently asked questions
Should I do the CIPP/E, CIPP/US or CIPM first, or the AIGP first?
If your work is primarily privacy law in one jurisdiction, start there — CIPP/E for Europe, CIPP/US for the United States, CIPM if the job is running a privacy programme rather than the law itself. If your work is already AI governance, or your organisation is facing the EU AI Act now, there is no requirement to hold a privacy credential first: the AIGP stands alone.
Does holding a CIPP make the AIGP easier?
It helps with part of it, not the whole thing. AIGP's law-and-standards domain overlaps with data-protection concepts a CIPP holder already knows, so that section feels familiar. The AI foundations and technical-governance material — how models are built, tested and monitored — is new regardless of which CIPP you hold.
Can I take the AIGP with no privacy background at all?
Yes. The AIGP has no prerequisite and does not require a CIPP, CIPM or CIPT first. Coming in with no privacy background means more of the syllabus is new, which affects study time more than eligibility — plan for the longer end of the 30–60 hour range.
Set on the AIGP? See how to study for it and the best prep material. Still deciding whether it is the right credential at all? See how it compares to the rest of the field.
AI Governance Study is an independent study aid. It does not represent a government entity: it is not affiliated with, endorsed by or authorised by any government, government agency or regulatory authority, and it does not provide government services or legal advice. Laws and frameworks are described in our own words — the official texts are listed at official sources. It is also not affiliated with, endorsed by, or sponsored by the IAPP. The AIGP name is used only to identify the exam this material helps you prepare for.