ISACA now has four AI certifications, and they divide the work by profession. The AAISM is for security managers, the AAIA for auditors, the AAIR for risk professionals, and the AAIG, still in a closed beta, for governance leaders. The three that are live share the same exam: 90 multiple-choice questions in 150 minutes, US$459 for ISACA members and US$599 for nonmembers, scored from 200 to 800 with 450 to pass. What separates them is who may take each one and what each exam weighs most. This guide sets the four side by side from ISACA's own candidate guides and credential pages, explains the differences that matter, and ends with which one fits which career.
The short answer
- AAISM, Advanced in AI Security Management: for holders of an active CISM or CISSP who secure AI across an enterprise. Its heaviest domain is AI Technologies and Controls, at 38%.
- AAIA, Advanced in AI Audit: for holders of a CISA or a listed audit or accounting designation who audit AI. Its heaviest domain is AI Operations, at 46%.
- AAIR, Advanced in AI Risk: launched on April 15, 2026, for holders of one of a listed set of certifications, the CISM and the CISSP among them, with experience in IT risk or advisory roles. Its heaviest domain is AI Risk Program Management, at 42%.
- AAIG, Advanced in AI Governance: in a beta program whose application period is closed; for CGEIT holders or people with six years of enterprise governance experience, at least one of them in AI.
- Same exam shell for the three live ones: 90 questions, 150 minutes, US$459 or US$599, 450 to pass.
- A CISM or CISSP opens both the AAISM and the AAIR, the AAIR with IT risk or advisory experience as well; the choice between them is security against risk.
ISACA's AI certifications at a glance
| AAISM | AAIA | AAIR | AAIG | |
|---|---|---|---|---|
| Work it certifies | AI security management | AI audit | AI risk management | AI governance |
| Status | Live, launched August 2025 | Live | Live, launched April 15, 2026 | Beta, applications closed |
| Who qualifies | An active CISM or CISSP | A CISA, or a listed audit or accounting designation | A listed certification, CISM and CISSP included, plus IT risk or advisory experience | An active CGEIT, or six years of enterprise governance experience, one in AI |
| Domains and shares | Governance and program management 31%; risk and opportunity 31%; technologies and controls 38% | Governance and risk 33%; operations 46%; auditing tools and techniques 21% | Risk governance and framework integration 37%; life cycle risk 21%; risk program management 42% | Not yet published |
| Exam | 90 questions, 150 minutes | 90 questions, 150 minutes | 90 questions, 150 minutes | Not yet published |
| Fee (member / nonmember) | US$459 / US$599 | US$459 / US$599 | US$459 / US$599 | Not published |
| Languages | English, Spanish, Japanese | English, Simplified Chinese, Spanish | English, Spanish, Chinese | Not yet published |
ISACA's 2026 AI Pulse Poll release names the three live ones together as "three new credentials: Advanced in AI Audit (AAIA), Advanced in AI Security Management (AAISM) and Advanced in AI Risk (AAIR)". The AAIG appears on ISACA's credentials list as a beta, and its CPE requirement is already in ISACA's CPE policy beside the other three.
What each certification is for
Each guide describes its candidate in a sentence.
AAISM. "Designed for IT security professionals with a CISM or CISSP certification looking to gain recognition for their expertise in securing enterprise AI solutions and leveraging AI to improve security operations." Its three domains follow a security program: governance and program management, risk and opportunity management, and technologies and controls, the last carrying 38% of the exam.
AAIA. The AAIA guide says the credential is "Designed for IT Audit professionals with a CISA, CIA (IIA) or CPA (AICPA) certification looking to gain recognition for their expertise, assuring AI-driven processes comply to the highest industry standards." ISACA's AAIA page calls it "The World's First Advanced AI Audit Certification". Its domains are AI Governance and Risk (33%), AI Operations (46%) and AI Auditing Tools and Techniques (21%).
AAIR. The AAIR guide: "The ISACA Advanced in AI Risk (AAIR) certification is meticulously crafted to equip professionals with the knowledge and skills to identify and evaluate AI risk for responsible enterprise adoption." Its domains are AI Risk Governance and Framework Integration (37%), AI Life Cycle Risk Management (21%) and AI Risk Program Management (42%).
AAIG. ISACA's page describes "a vendor-neutral certification designed for experienced governance professionals tasked with leading AI adoption and key initiatives at the enterprise level". For now, "The AAIG beta program is in progress", and the page's study material is listed as "Coming soon!"
Who qualifies for each
This is where the four differ most, and where your current credentials may decide for you.
- AAISM: "AAISM candidates must hold an active CISM or CISSP certification." Nothing else qualifies.
- AAIA: ISACA's AAIA page: "To qualify for AAIA, candidates must either hold a CISA certification or one of the following designations with an IT audit or IT advisory role focus: CIA, US CPA, ACCA or FCCA, Canadian CPA, Australian CPA or FCPA or the Japanese CPA designation." The page's full list adds further accounting designations.
- AAIR: the widest door. Its guide lists designations from ISACA, including the CISA, CISM, CRISC, CGEIT and CDPSE, and from other bodies, including ISC2's CISSP and CGRC, the IIA's CIA and CRMA, and PMI's PMI-RMP. ISACA's launch release adds experience: candidates "must have proven experience in IT risk or advisory roles", as well as hold one of the prerequisite certifications.
- AAIG: the only one with an experience route instead of a certification. ISACA's page lists active CGEIT holders, or six years of enterprise governance experience, including at least one in AI.
Two consequences follow. A CISA holder can take the AAIA, or the AAIR with the experience it asks for, but not the AAISM. A CISM or CISSP holder can take the AAISM, or the AAIR with that experience, but not the AAIA, unless they also hold a CISA or one of the listed designations.
AAISM vs AAIA: security or audit?
The AAISM and the AAIA look at the same AI systems from opposite sides. A security manager designs and runs the controls; an auditor gives assurance that they exist and work. The domain weights show it. The AAIA puts 46% on AI Operations and keeps a domain for AI Auditing Tools and Techniques; the AAISM puts 38% on AI Technologies and Controls and 31% on running a governance and security program.
Choose by the job you do, and the prerequisites usually choose for you. If you hold a CISA and your work is audit or assurance, the AAIA is the natural step; if you hold a CISM or CISSP and you own AI security decisions, the AAISM is. Few people need both.
AAISM vs AAIR: security or risk?
This is the comparison that matters most for AAISM candidates, because both doors may be open to you: the CISM and the CISSP are among the AAIR's qualifying certifications as well as the AAISM's, and the AAIR adds only its call for experience in IT risk or advisory roles.
The overlap is real. The AAISM gives 31% to AI risk and opportunity management, its Domain 2, and the AAIR is risk throughout. The difference is emphasis. The AAIR spends 42% on running an AI risk program and 37% on risk governance and framework integration; its candidates, in ISACA's words, are trained "to recommend effective responses to AI risk, collaborate across functions to ensure comprehensive communication and oversight, and develop a deep understanding of diverse AI technologies and their associated challenges." The AAISM spends its largest share on the security technologies and controls themselves, from AI security architecture to monitoring, and asks you to design and run them.
A rough test: if your recommendations end in a decision to accept, treat, transfer or avoid a risk, look at the AAIR; if they end in a control to implement, the AAISM is closer to your work.
What about the AAIG?
The AAIG is ISACA's AI governance credential, and it is not open yet. Its page says: "The AAIG Beta Application Period Is Now Closed", and "The AAIG beta program is in progress." ISACA describes it as validating the ability "to guide responsible AI adoption through strategy, governance frameworks, risk oversight and data governance". It publishes no exam format, fee or domain weights for a general release yet.
Two things are already known. Its qualification is different from the others: an active CGEIT, or six years of enterprise governance experience with at least one in AI. And ISACA's CPE policy already lists it with the others, at 30 hours over three years. If AI governance is your field and you do not hold a CISM, CISSP or CISA, the AAIG is the ISACA credential to watch. The IAPP's AIGP is an AI governance credential outside ISACA, and AIGP vs ISACA's AAIG, AAISM and AAIA compares them from that side.
Which ISACA AI certification should you take?
Start from what you hold and what you do.
- You hold a CISM or CISSP and own AI security decisions: the AAISM.
- You hold a CISM or CISSP and your work is risk assessment and risk programs: the AAIR, or the AAISM if controls are where your recommendations land.
- You hold a CISA or a listed audit or accounting designation and audit AI: the AAIA.
- You hold a CRISC, CGEIT, CDPSE or another listed risk designation: the AAIR.
- You lead governance and hold a CGEIT, or have six years of governance experience including AI: watch for the AAIG's launch.
If two fit, take the one whose domains describe the work you will be doing next year, not the work you did last year. For AI credentials beyond ISACA's, see best AI security certifications in 2026.
Can you hold more than one?
Yes, and ISACA makes it cheaper to keep several than to earn them. Each exam has its own US$459 or US$599 fee, but ISACA's AAISM maintenance page says: "Regardless of how many ISACA Advanced certifications you hold your total annual maintenance for all of your Advanced certifications will be $20/35." Continuing education can overlap too. ISACA's CPE policy allows that "The use of these hours for meeting the CPE requirements for multiple ISACA Advanced certifications is permissible when the professional activity appropriately maps to each ECO."
So a CISM holder who earns the AAISM and later the AAIR pays one annual fee for both and can count an hour of AI risk training toward each where it fits both outlines. AAISM certification requirements sets out the CPE rules in full.
How the exams compare
The three live exams are built the same way. Each guide gives "2.5 hours (150 minutes)" and 90 multiple-choice questions, and each scores on "a common scale from 200 to 800" with 450 to pass. The languages differ: the AAISM in English, Spanish and Japanese, the AAIA in English, Simplified Chinese and Spanish, and the AAIR in English, Spanish and Chinese.
Because the shell is the same, what makes one harder than another for you is the content. A security manager meets familiar ground in the AAISM's controls and less familiar ground in the AAIA's audit techniques; an auditor finds the reverse. How hard is the AAISM exam? takes the AAISM's difficulty feature by feature.
Where to start
If the AAISM is the one for you, try its content before you pay. A free account opens the first topic, AI governance and regulation, in full: its 147 questions with rationales, its lessons and its flashcards, plus a short diagnostic and a study plan. Is the AAISM worth it? weighs the credential on its own, and the AAISM exam guide shows every topic. Full access to all 63 lessons and 1,717 questions is a single payment, with nothing to renew. If you hold a CISA or a listed audit or accounting designation and audit AI, start with our AAIA exam guide instead, and AAIA vs CISA for how the two audit credentials fit together.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.