Best AI governance certifications: how they compare
Six credentials come up when the question is "which AI governance certification should I get" rather than "how do I prepare for the AIGP". They test different things, assume different starting points, and are not interchangeable. Here is what each one actually is.
A disclosure first: this site sells AIGP preparation, so read that section with it in mind. The other credentials are described the same way regardless — we sell training for none of them.
The credentials, at a glance
| Credential | Issuing body | Prerequisite | Format |
|---|---|---|---|
| AIGP | IAPP | None | 100 questions, 3 hours, one exam |
| ISO/IEC 42001 Lead Implementer / Lead Auditor | Accredited training providers (PECB, BSI and others) | None required; management-system experience assumed | Multi-day training bundled with the exam |
| ISACA AAISM | ISACA | CISM or CISSP | Exam extension on the base credential |
| ISACA AAIA | ISACA | CISA or an equivalent audit designation | Exam extension on the base credential |
| ISACA AAIR | ISACA | CRISC or one of ~25 qualifying credentials | Exam extension, launched April 2026 |
| EXIN AICP | EXIN | None published | One exam |
IAPP AIGP
The broadest of the group and the only one with no prerequisite that is not also a narrow specialty. It spans four domains — AI foundations, the surrounding law and standards, and the operational governance of AI systems through development and deployment — rather than one function. That breadth is also its limit: it goes less deep into any single law than a credential built around that law alone. Full detail is in the AIGP exam guide; whether it is worth sitting at all is covered separately at is the AIGP worth it.
ISO/IEC 42001 Lead Implementer and Lead Auditor
A different kind of credential from the other five. ISO/IEC 42001 is an AI management-system standard that an organisation gets audited and certified against — the AI equivalent of ISO/IEC 27001 for information security. Lead Implementer and Lead Auditor are individual credentials awarded by accredited training providers such as PECB and BSI, aimed at the people who will actually build or audit that management system inside a company. Training is mandatory, not optional, and the price reflects it: self-study through PECB runs roughly $600–$900, and instructor-led courses from various providers run $2,000–$5,000. This is the route for someone whose job is that specific implementation or audit work, not a general "AI governance professional" credential.
ISACA's AI extensions: AAISM, AAIA, AAIR
ISACA did not build one AI governance certification — it built three specialty extensions that bolt onto certifications it already runs: AAISM for AI security (requires CISM or CISSP), AAIA for AI audit (requires CISA or an equivalent audit designation), and AAIR for AI risk (requires CRISC or one of roughly 25 qualifying credentials, launched April 2026). None of the three is reachable from zero — each assumes you already hold, and paid for, the base certification. If you are not already ISACA-certified, none of these three is where you start; the natural next step once you are is whichever extension matches the base credential you hold.
EXIN AI Compliance Professional (AICP)
A single-exam credential built around direct compliance mapping rather than broad theory: it ties its material explicitly to EU AI Act Articles 8–10, ISO/IEC 42001, ISO/IEC 23894 and the NIST AI Risk Management Framework, and is positioned around templates and checklists for doing the compliance work rather than describing it. It has no published prerequisite, which puts it in the same reachable-from-zero category as the AIGP, aimed more narrowly at compliance officers, legal teams and auditors already doing EU AI Act work specifically.
Which one to start with
- No existing certification, want the broadest starting point: AIGP — the only credential here with no prerequisite that covers governance broadly rather than one function.
- Already hold CISM, CISSP, CISA or CRISC: the matching ISACA extension is the natural next step, and cheaper than starting elsewhere from zero.
- Your job is implementing or auditing an AI management system inside one organisation, specifically against ISO/IEC 42001: Lead Implementer or Lead Auditor, despite the higher upfront training cost.
- Your job is EU AI Act compliance specifically, and you want article-by-article mapping: EXIN's AICP.
These are not mutually exclusive. Professionals working in this field full time tend to accumulate more than one over a career, in whichever order their job requires it.
Frequently asked questions
Is ISO/IEC 42001 a certification for people or for companies?
Both, but they are different things. ISO/IEC 42001 itself is a management-system standard — an organisation gets audited and certified against it, the way ISO/IEC 27001 works for information security. Lead Implementer and Lead Auditor are the individual credentials that sit on top of it, for people who do that implementation or audit work.
Can I get an AI governance certification with no professional experience?
AIGP has no published prerequisite, and neither does EXIN's AICP. ISO/IEC 42001 training will enrol anyone but assumes some familiarity with management systems. ISACA's three AI extensions are the exception: each requires already holding one of ISACA's base certifications (CISM, CISSP, CISA or an equivalent, or CRISC), which do carry their own experience requirements.
Which of these is the cheapest?
On exam fee alone, ISACA's AI extensions are the cheapest — but only reachable after already holding, and having paid for, the prerequisite certification. Of the credentials with no prerequisite, AIGP and EXIN's AICP are priced closer to each other than either is to a mandatory multi-day ISO/IEC 42001 training course.
Do these certifications expire?
AIGP runs on a two-year term: 20 CPE credits plus a US$250 maintenance fee, waived while an IAPP membership is active. ISACA's certifications, including its AI extensions, run on ISACA's own continuing-education and annual maintenance cycle. ISO/IEC 42001 Lead Implementer and Lead Auditor credentials carry ongoing CPD requirements set by the issuing training body (PECB, BSI and others differ slightly). Check the specific issuer before assuming any of these is a one-time purchase.
Decided AIGP is the one to start with? The comparison of prep material for it is at best AIGP exam prep, and the exam itself is covered in full at the AIGP exam guide.
Third-party prices and prerequisites checked September 2026 and rounded; issuing bodies change these without notice, so confirm directly before paying. We have no affiliate relationship with any credential or provider named on this page.
AI Governance Study is an independent study aid. It does not represent a government entity: it is not affiliated with, endorsed by or authorised by any government, government agency or regulatory authority, and it does not provide government services or legal advice. Laws and frameworks are described in our own words — the official texts are listed at official sources. It is also not affiliated with, endorsed by, or sponsored by the IAPP. The AIGP name is used only to identify the exam this material helps you prepare for.