AIGP vs AAISM: IAPP AI Governance or ISACA AI Security Management?

By Kyle Tice · Updated October 19, 2026 · Facts checked against official exam pages

Pick AIGP if you work in privacy, legal, compliance or risk and need to show you can govern AI across its lifecycle and under laws like the EU AI Act. Pick AAISM if you are a security manager who already holds CISM or CISSP and owns AI security controls. In most cases the prerequisites decide for you: AIGP is open to anyone, while AAISM is only for people with an existing security management credential. If you are an auditor with CISA, look at ISACA’s AAIA instead.

The gate: who is allowed to sit each exam

This is the first thing to check.

• AIGP (IAPP): no prerequisite. A lawyer, a product manager or a data scientist can book it.
• AAISM (ISACA): you must hold an active CISM or CISSP. ISACA also suggests experience in security or advisory roles and some hands-on exposure to AI systems.
• AAIA (ISACA): you must hold an active CISA, or a CIA, US CPA or ACCA with an IT audit or advisory focus.

ISACA’s “Advanced in AI” credentials are add-ons for people who are already certified. They are not entry points. If you do not hold CISM, CISSP or CISA, the real comparison is AIGP versus getting one of those first, which is a large project in itself.

Content and domains

AIGP Body of Knowledge, four areas:

1. Foundations of AI governance: what AI is, why it needs governance, policies across the AI lifecycle
2. How laws, standards and frameworks apply to AI: privacy law, other existing law, AI-specific laws and industry standards
3. Governing AI development: design, training and testing data, release and monitoring
4. Governing AI deployment and use: deployment decisions, assessments and ongoing use

AIGP is wide and policy-focused. You will need to know the EU AI Act, the NIST AI RMF and ISO/IEC 42001, and how data protection law touches AI. The questions include case studies.

AAISM, three domains:

• AI governance and program management
• AI risk management
• AI technologies and controls

ISACA does not list weights on the main page. Third-party prep providers report 31% governance, 31% risk and 38% technologies and controls. Note that last one: AAISM goes much further into technical security controls than AIGP does.

AAIA, for comparison, covers AI governance and risk, AI operations, and AI auditing tools and techniques. It is the auditor’s version: how to test whether AI controls work, rather than how to design them.

Put simply: AIGP asks “is this AI use lawful and well governed?” AAISM asks “is this AI system secure and its risks controlled?” AAIA asks “can I prove the controls work?”

Difficulty

We rate AIGP 3 out of 5 and AAISM 4 out of 5.

AIGP’s difficulty is volume. IAPP’s study guide describes a three-hour exam of 100 multiple-choice items, including case studies and multi-select questions with no partial credit. IAPP recommends at least 30 hours of study.

AAISM is reported at 90 questions in 150 minutes. It is harder because ISACA writes questions from a manager’s point of view: the “best” answer is often about priority and accountability rather than a technical fix. CISM holders will recognise the style. The prerequisite means every candidate already has security depth, so the bar is set accordingly.

Cost and validity

As of October 2026:

AIGP cost per year: a non-member pays $799, and IAPP includes the first maintenance fee, so the first two-year term is about $400 a year. After that, $250 per two-year term ($125 a year) plus whatever your 20 CPE credits cost. Members pay $649 plus membership (listed at $295 a year), but maintenance is covered.

AAISM cost per year: $649 up front for a non-member including the application fee, plus ISACA’s maintenance fees and CPE. You are also already paying to maintain CISM or CISSP. For a CISM holder, adding AAISM is cheap at the margin; for anyone else it is not possible.

Employer recognition

We rate AIGP 4 out of 5 for employer demand and AAISM 3.

AIGP is the best-known AI governance credential, and IAPP’s large privacy community gives it reach in legal and compliance teams. Reported salary data for AIGP-aligned roles sits around $141K–$170K in the US, though that reflects the seniority of people who hold it as much as the cert itself.

AAISM is newer and narrower. It signals something specific and valuable: a security leader who understands AI risk. For a CISO or deputy CISO, it pairs naturally with CISM. Expect demand to grow as AI security budgets do, but today fewer postings name it.

In regulated industries, both certs carry more weight than in tech startups, where hiring managers lean on experience. See our AI governance and AI security guides for the wider field.

Study effort

• AIGP: 40–60 hours. Use the official Body of Knowledge and exam blueprint, IAPP’s training and its 100-question practice exam. Read primary texts: the EU AI Act’s risk tiers and the NIST AI RMF core functions.
• AAISM: 30–50 hours on top of your CISM or CISSP knowledge. ISACA offers a practice database of 200+ questions. Most of the new learning is AI-specific threats and controls.

Who should take both

AI governance leads who sit between legal and security, such as a head of AI risk, often benefit from both. AIGP covers the regulatory and lifecycle view; AAISM proves you can run the security programme. If you hold CISM, take AAISM first because you already have most of the foundation, then add AIGP for the legal depth.

Auditors should swap AAISM for AAIA in that plan.

Who should skip

• Engineers who want to build safe AI systems. These are management and governance credentials. Look at CompTIA SecAI+ or a cloud developer cert.
• Anyone early in their career. AIGP has no prerequisite, but without some work experience in privacy, risk or compliance, the case studies are hard to read and the credential is hard to use.

FAQ

Can I take AAISM without CISM or CISSP?

No. ISACA requires an active CISM or CISSP.

How long is the AIGP exam?

IAPP’s study guide says three hours for 100 items. Some third-party sources quote 2 hours 45 minutes; follow the time shown on your Pearson VUE appointment.

What is the difference between AAISM and AAIA?

AAISM is for security managers designing and running AI security programmes. AAIA is for auditors assessing AI controls, and it requires CISA or an equivalent.

Is AIGP worth it without a law degree?

Yes, for privacy, compliance, risk and product roles. The exam tests how laws apply to AI, not legal practice.

See all governance and security options on /rankings/.