AI governance jobs are hard to search for because they rarely share a title. The work turns up as a privacy counsel's new duty, a risk manager's extra committee, a product lead's review step or a role with "responsible AI" somewhere in its name. On September 30, 2026 the IAPP, which runs the AIGP, published its answer to the question of what these jobs are: the AI Governance Skills Framework, built from its own surveys and from public job profiles collected between January and July 2026. This guide sets out what the framework says, what the IAPP's AI Governance Profession Report found about where the work sits and who is hired, how people move into it, and where the AIGP's Body of Knowledge meets each kind of work.
The short answer
- What the jobs are: the IAPP sorts AI governance work into eight types: policy, governance, technical, product, ethics, risk, legal and assurance. Its framework adds executive functions on top.
- How they are staffed: "most organizations are unlikely to assign a different person to each profile", the IAPP says; one role is likely to carry two or more types of work.
- Where they sit: in the IAPP's survey, privacy and legal and compliance each came out at 22% as the function with primary responsibility for AI governance, ahead of IT at 17%.
- Demand: only 10 of 671 respondents expected to need no more AI governance staff within a year.
- How people get in: mostly from an adjacent discipline, privacy above all. An opinion piece the IAPP published cites its salary survey as finding that 68% of privacy professionals have taken on AI governance responsibilities.
- Where the AIGP fits: its Body of Knowledge covers the ground of all eight types at the level of governance, not engineering.
What is an AI governance job?
The IAPP's article opens on that question and answers it plainly: "As it turns out, the work of AI governance is not just one thing. Many have called AI governance a team sport, and our research validated that analogy. The work is not limited to one person or role; it is spread across a variety of roles and job functions."
The framework was built to give that spread a common language. Its method, in the IAPP's words: "we looked at responses from the IAPP's annual surveys from 2023-2026", which showed "whether or not AI governance tasks were being added to existing positions, or if these were net new roles". Then: "From January to July 2026, we collected public job profiles that explicitly called for AI governance work." The result has two parts. "Part I: Executive Functions identifies leaders responsible for AI governance oversight and accountability." "Part II: Professional Profiles defines a comprehensive range of roles that encompass the key functions needed to support responsible AI."
One sentence from the article matters more than any other to a job seeker: "For an industry that is still nascent, the work seems to be more common than the label." That is why the framework records alternative titles for each profile, and why a search for "AI governance" alone misses most of the jobs that do this work.
The eight types of AI governance work
The public article names the eight types without the detail, which sits in the member profiles: "we categorized the work into eight types: policy, governance, technical, product, ethics, risk, legal and assurance." What each covers can be read off the AIGP's Body of Knowledge, which lists the tasks the IAPP expects an AI governance professional to know. The pairing below is ours, not the IAPP's; each line quotes the indicator that comes closest.
| Type of work | Where the Body of Knowledge describes it |
|---|---|
| Policy | I.C: "Create and implement policies to ensure oversight and accountability across all AI life cycle stages" |
| Governance | I.B: "Define roles and responsibilities for AI governance stakeholders." |
| Technical | III.B: "Plan and perform training and testing of the AI model and system" |
| Product | III.A: "Define the business context and use case of the AI system." |
| Ethics | I.A: "Identify and apply the common principles of responsible AI" |
| Risk | III.A: "Identify and manage the internal and external risks and contributing factors related to designing and building the AI model and system" |
| Legal | IV.B: "Identify and evaluate key terms and risks in the vendor or licensing agreement." Domain II covers the laws themselves. |
| Assurance | III.C: "Conduct periodic activities to assess the AI system’s performance, reliability and safety (e.g., audits, red teaming, threat modeling and security testing)." |
Two points follow from the table. Every type of work has a home in the AIGP's syllabus, which is what a governance credential is for: it gives each of the eight the same vocabulary. And the technical row is the one where the Body of Knowledge stops at governance. It asks an AI governance professional to plan and oversee testing, not to write the tests, which is the line the IAPP draws between governing AI and building it.
AI governance roles and responsibilities
The framework's two parts describe two kinds of responsibility.
The executive functions are about accountability rather than daily work. The article explains that "Given the number of executive roles identified, these are grouped into strategic domains", that the framework records only knowledge and accountability for them, and that "It is important to note that these leaders are not likely to be involved in all AI governance decision-making — only when it is relevant to their area of practice." In practice, an executive such as a general counsel or a chief information security officer answers for the part of AI governance that touches their field, and the professionals below them carry the rest; the framework's own list of executive domains is in the member version.
The professional profiles are the jobs. The IAPP expanded them "to reflect the different versions of work including more senior and junior roles and various functions", and it warns against reading them as a hiring list: "it is unlikely that any given organization will require every profile to be included within their AI governance teams." The article ties the profiles back to the Profession Report: "However, most organizations are unlikely to assign a different person to each profile. Instead, it is likely a single role will be responsible for two or more of these functions. The skills profiles organizations prioritize will depend on their size, complexity and the types of AI they develop or deploy."
It also names the cost of getting this wrong: "Product, legal, engineering, and policy teams all play a role in AI governance, but without clear delineations of roles and responsibilities, siloed efforts can lead to redundant and misaligned work." That is the same concern as the Body of Knowledge's competency I.B, which asks candidates to "Define roles and responsibilities for AI governance stakeholders" and to "Establish cross-functional collaboration in the AI governance program (e.g., for efficacy and diversity of expertise and perspective)."
Two limits are stated openly. "At present, the AIGSF is industry and domain agnostic." And the IAPP notes that "governance approaches for AI developers may differ from those for AI deployers", a distinction it plans to explore in later versions.
Where AI governance jobs sit in an organization
The IAPP's AI Governance Profession Report 2025, written with Credo AI, gives the organizational picture. It found that "There is no clear best practice for how to build and organize an AI governance team", and it measured where the work lands. The functions most often given primary responsibility for AI governance were privacy (22%), legal and compliance (22%), IT (17%), data governance (10%), ethics and compliance (6%) and security (5%). By another cut, "the data shows 50% of AI governance professionals are typically assigned to ethics, compliance, privacy or legal teams."
The report expects those functions to carry more, not less: "Over 50% of respondents indicated the following disciplines would gain additional responsibility: privacy, IT, security, and legal and compliance." And size changes the shape of the job: "While larger companies can split these tasks into several roles, smaller companies will look for AI governance professionals who can cover all these areas."
For a job seeker, that last sentence is the practical one. In a large organization you can specialize in one of the eight types. In a small one, the person hired is expected, in the report's words, to "cover all these areas".
Are AI governance jobs in demand?
The Profession Report's survey, run in spring 2024 with more than 670 respondents in 45 countries and territories, points one way. "Of surveyed organizations, 77% are currently working on AI governance, with a jump to near 90% for those organizations already using AI." "Few organizations are satisfied with their level of AI governance staffing, with only 10 out of 671, or 1.5%, reporting they will not need additional staff in the next 12 months." And talent is short: "Of respondents, 23.5% said finding qualified AI professionals was part of the challenge delivering AI."
It also describes how teams grow, which tells you where the openings come from: "Companies are building these teams incrementally, starting with tasking the existing workforce and then hiring and empowering senior managers and executives, which the data suggests leads to fewer issues using AI and reporting on AI governance, among other positive outcomes."
These are survey answers about organizations' plans, not counts of vacancies; the IAPP does not publish a number of open AI governance jobs. What it shows is a field where nearly every surveyed organization expected to need more people and many reported difficulty finding them.
How to get into AI governance
The IAPP's sources point to three routes.
From privacy. The Profession Report says "Respondents indicated AI governance professionals come from different disciplines and areas of expertise, and a strong number of privacy professionals are continually asked to take on AI governance roles." It adds that "Many of the case studies illustrate how newer AI governance programs hire managers with prior experience in a digital governance discipline, like privacy." An opinion piece the IAPP published on June 24, 2026 puts a figure on it: "The IAPP Salary and Jobs Report 2025-26 finds that 68% of privacy professionals have taken on AI governance responsibilities." The same piece offers a way to sort the new work: "In practice, the work tends to fall into four categories: what privacy professionals already know how to do, what privacy professionals need to learn, what belongs with another function, and what should be procured or supported externally." On the learning, it is specific: "Privacy professionals do not need to become machine learning engineers, but they do need enough fluency to ask questions that a standard privacy intake form may not capture."
From legal, compliance, risk, IT and data governance. These are the other functions the Profession Report found leading AI governance, and the ones it expects to gain responsibility. The skills it describes suit them: qualified AI governance professionals "should, of course, understand AI but also have experience in governance, risk and compliance, and they should be able to translate legislative requirements into actionable policies, for example."
From technical work. The report notes that "Certain skills, such as red teaming, will be increasingly necessary", and the framework keeps a technical type of AI governance work. An engineer moving in brings the system knowledge; what governance adds is the law and the accountability around it.
Entry-level AI governance jobs
The framework includes junior profiles, since it was expanded to reflect "more senior and junior roles", but the public article does not list them. What the IAPP's evidence does show is how most people start: with AI governance tasks added to a job they already hold. The framework's method looked at exactly that question, whether tasks "were being added to existing positions, or if these were net new roles", and the Profession Report found teams built "starting with tasking the existing workforce".
So the most reliable entry route the IAPP's data supports is the adjacent one: take on the AI part of a privacy, compliance, risk or IT role, document what you did, and build from there. A search for alternative titles, in the framework's own spirit, finds more openings than a search for "AI governance".
What AI governance jobs pay
The IAPP's Salary and Jobs Report 2025-26 was the first edition of its salary survey to include AI governance salaries. Half of the respondents working only in AI governance earn less than USD151,800; half of those working in both privacy and AI governance earn more than USD169,700; and in the technology sector, technical AI governance roles had the survey's highest median, USD221,000. AIGP salary: what the IAPP's own data shows sets out the figures and their limits.
Where the AIGP fits
The IAPP's certification index says "AIGP is for professionals in all industries who need to understand and execute responsible AI governance." The table above shows why that breadth fits the framework: the Body of Knowledge's four domains, from foundations and law to development and deployment, run through all eight types of work. A policy lead, a risk manager, a lawyer and a product manager can all take the same exam because it tests the ground they share, and the IAPP expects a single role to cover two or more of the eight types anyway.
It is not a technical certification, and it is not a substitute for experience. The IAPP publishes no experience requirement for the exam, so the credential shows knowledge, not years in the field. Best AI governance certifications in 2026 compares it with the other credentials in the field.
Where to start
If you are moving into AI governance, the AIGP's first competency, AI and the need for governance, is free in full with a free account: five lessons, 100 questions and 118 flashcards on what AI is, its risks and harms, and the principles of responsible AI. That is the vocabulary all eight types of work share. The rest of the course follows the Body of Knowledge through the law, development and deployment, with practice in the exam's format. Is the AIGP worth it? helps with the decision, and How to study for the AIGP: a 30-hour plan sets out the hours around a job.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.