Artificial Intelligence Governance Professional (AIGP)

Learning plan

About 50 hours of focused study, split into 5 phases. Pick your weekly pace and the timeline adjusts.

Estimated finish: 5 weeks

What the exam covers

Source: official exam guide. Weights can change, so check before you start.

Before you start

• No formal eligibility rules, but a working grasp of privacy concepts (lawful basis, DPIAs, controller vs processor) makes Domain II much faster
• Download the AIGP Body of Knowledge v2.1 (effective 2 February 2026) and keep it open; every phase below maps to its competency codes (I.A to IV.C)

1. Week 1 · 10 h

   AI governance foundations (Domain I)

   • Define AI, machine learning, generative and agentic AI, and list the characteristics that make AI need its own governance (opacity, autonomy, scale, probabilistic outputs, data dependency)
   • Map the responsible-AI principles (fairness, safety, privacy, transparency, accountability, human-centricity) to concrete harms to individuals, groups, organisations and society
   • Distinguish developers, providers, deployers and users, and assign governance roles across legal, privacy, security, data science and procurement
   • Outline AI life-cycle policies, from use-case intake to incident management, plus third-party and acceptable-use policies

   Hands-on: Draft a two-page AI acceptable-use policy and a RACI chart for a 500-person company that is rolling out a chatbot. Name who approves new use cases, who signs off on risk and who handles incidents.

   Use: IAPP AIGP certification page and Body of Knowledge · IAPP free study guides · OECD AI Principles

2. Weeks 2–3 · 14 h

   Laws, standards and frameworks (Domain II)

   • Apply GDPR-style principles (lawful basis, purpose limitation, minimisation, data subject rights, automated decision-making, DPIAs) to AI training and inference
   • Explain how IP, non-discrimination (employment, credit, housing, insurance), consumer protection and product liability law reach AI systems
   • Classify systems under the EU AI Act (prohibited, high, limited, minimal risk), list high-risk obligations (risk management, data governance, technical documentation, human oversight, conformity assessment, QMS), GPAI duties and penalty tiers
   • Recall the NIST AI RMF core functions (Govern, Map, Measure, Manage), the OECD principles and the scope of ISO/IEC 22989, 42001 and 42005

   Hands-on: Take five real systems (CV-screening tool, customer-service chatbot, spam filter, emotion recognition at work, credit-scoring model) and place each in an EU AI Act risk tier. Cite the article or Annex III entry for each, and say whether your organisation would be the provider or the deployer.

   Use: EU AI Act Explorer (full text by article) · NIST AI Risk Management Framework · NIST AI RMF Playbook

3. Weeks 3–4 · 11 h

   Governing AI development (Domain III)

   • Run an AI impact assessment covering business context, a probability/severity harms matrix, a mitigation hierarchy and stakeholder mapping
   • Set data-governance requirements, including lawful rights to the training data, data quality and fit-for-purpose checks, lineage and provenance
   • Plan training and testing across unit, integration, validation, performance, security, bias and interpretability tests, and document the results
   • Prepare a system for release with a model card, conformity evidence, a monitoring and retraining schedule, red teaming and post-market monitoring

   Hands-on: Write an impact assessment for a resume-ranking model. Include a 5x5 harms matrix, three bias tests with pass/fail thresholds, a data-provenance table and a one-page model card.

   Use: NIST AI 600-1 Generative AI Profile · IAPP – How to prepare for your exam

4. Weeks 4–5 · 9 h

   Governing AI deployment and use (Domain IV)

   • Compare deployment choices (proprietary vs open-source, small vs large, cloud vs on-premise vs edge, as-is vs fine-tuned vs RAG vs agentic) and their governance trade-offs
   • Run a deployer-side assessment of a third-party model, including vendor due diligence, contract terms, transparency notices and human-oversight design
   • Set up post-deployment monitoring for drift, incidents, user feedback and decommissioning criteria

   Hands-on: Build a 20-question vendor due-diligence questionnaire for buying a third-party LLM API. Cover training data, retention, sub-processors, evaluation results, incident notification and indemnities.

   Use: NIST AI RMF Playbook (Manage function)

5. Week 5 · 6 h

   Practice exams and BoK gap review

   • Score every BoK performance indicator 1–3 for confidence and re-study anything rated 1
   • Do the sample questions in the official AIGP study guide under timed conditions, then one full 100-question mock in 165 minutes
   • Re-read the EU AI Act articles on high-risk obligations and GPAI, which are the most heavily tested law content

   Use: IAPP AIGP study guide and sample questions

You're ready to book when…

• You can place any described system in an EU AI Act tier and name the provider and deployer obligations without notes
• You can name all four NIST AI RMF functions and give two outcomes for each
• You have produced an impact assessment and a model card yourself, not just read about them
• You score 75% or higher on a full timed mock

Exam tips

• The BoK publishes a minimum and maximum question count for each domain. Development and deployment (Domains III and IV) together make up about half the exam, so don't spend all your time on the law.
• BoK v2.1 (effective 2 February 2026) names the South Korean AI Basic Law and ISO/IEC 42005, and frames governance around generative and agentic AI. Older prep material may be missing these.
• Questions mostly test the understand/apply/analyse levels of Bloom's taxonomy, so practise applying a framework to a scenario rather than reciting definitions.