The AIGP Body of Knowledge v2.1, explained

The AIGP Body of Knowledge is a nine-page PDF, and it is the only document the exam is written from. The IAPP's candidate handbook says so in one sentence: "No question will be on the exam that is not covered by a topic or subtopic on that exam's body of knowledge." Version 2.1 is the edition in force, approved by the AIGP exam development board on September 9, 2025 and effective for anyone testing on or after February 2, 2026. This guide walks through it page by page: what the four domains cover, how the 13 competencies and 58 performance indicators are written, where the questions fall, what changed from the previous version, and how to read the verbs that tell you how deep a question can go.

What the document is for

The Body of Knowledge opens with its purpose: "The main purpose of the AIGP BoK is to document the knowledge and skills that will be assessed on the AIGP certification exam." It is written by the people who write the exam: "The BoK is developed and maintained by the subject matter experts that constitute each designation exam development board."

It is also the exam blueprint. The document "includes the exam blueprint numbers, which show the minimum and maximum number of questions from each domain that will be found on the exam." Those numbers are ranges rather than percentages, and they are printed at the head of each domain's table and beside each competency.

The handbook makes the document the center of any study plan: "The body of knowledge should serve as the candidate's core resource." The FAQs say the same thing in plainer words: "The exam is created based on this exact document, so nothing will appear on the test that isn't on the body of knowledge." And the study guide warns that no topic in it is safe to skip: "Questions may be asked from any of the topics listed under each area and can be used to guide your preparation."

Competencies and performance indicators

The content is laid out in two levels, and the Body of Knowledge defines both. "Competencies represent broad knowledge domains in which qualified professionals should be conversant. Performance indicators are the discrete tasks and abilities that validate the professional's level of proficiency in the broader competence group." Then the sentence that matters for study: "Exam questions assess an AI governance professional's proficiency on the performance indicators."

So the unit of the exam is the indicator, not the domain. There are 58 of them, under 13 competencies, under four domains. Each competency is a single sentence beginning with a verb, and each indicator under it is another verb-led sentence, often with examples in parentheses. The examples are not decoration: version 2.1's release note says examples "were added to some performance indicators for clarity", which tells you the exam development board expects candidates to recognize them.

The document also sets out its stance on the labels that the law uses. "Although some laws separate 'developers' from 'deployers' to assign liability, we use these labels only to describe distinct tasks. Many organizations will fill both roles." That is why Domain III (development) and Domain IV (deployment) overlap on monitoring, incidents and documentation: the same organization is expected to do both.

The four domains

The Body of Knowledge describes each domain in a short paragraph. Here they are, with the range of scored questions each carries out of 85.

Domain I "focuses on what AI governance is, including the common principles and pillars to build an AI governance program. This domain covers best practices regardless of industry, sector or size." Its three competencies are to understand what AI is and why it needs governance, to establish and communicate organizational expectations for AI governance, and to establish policies and procedures to apply throughout the AI life cycle.

Domain II "focuses on existing laws that apply to AI, as well as AI-specific laws, standards and frameworks. For the AI governance professional, this means an understanding of the major elements of current AI laws (e.g., the EU AI Act, the South Korean AI Basic Law, federal and state AI laws that apply to private sector organizations)." Its four competencies cover data privacy law, other existing law, AI-specific law, and industry standards and tools.

Domain III "focuses on the responsibilities of AI governance professionals with respect to designing, building, training, testing and maintaining AI systems." Its three competencies follow the life cycle: designing and building the system, the data used to train and test it, and its release, monitoring and maintenance.

Domain IV "focuses on the responsibilities of AI governance professionals with respect to selecting an AI model, then deploying and using it responsibly through ongoing monitoring maintenance, and other key obligations. This domain applies in any deployment context, such as a company deploying its own proprietary model or one from a third party." Its three competencies are the decision to deploy, assessing the system, and governing deployment and use.

Two domains out of four, the development and deployment domains, carry between 42 and 50 of the 85 scored questions. That is the first thing to take from the blueprint: more than half the exam is about doing governance across a system's life, not about defining it.

The 13 competencies and where the questions fall

Each competency has its own range. The AIGP exam guide lists every indicator under each; here is the blueprint in one table.

The two largest competencies are IV.C, deployment and use, and III.C, release, monitoring and maintenance. Together they carry 17 to 21 scored questions, about as many as the whole of Domain I. The smallest is II.D, industry standards and tools, at 3 to 5, which is a reason to learn its three indicators precisely rather than to skip them: a competency with three indicators and up to five questions tests each indicator more than once.

The indicator counts matter in the other direction too. I.C has three indicators for 6 to 8 questions, and IV.A has three for 6 to 8, so each of those indicators can carry two or more questions. II.C has six indicators for 6 to 8, roughly one each.

What Domain II actually names

Domain II is where candidates ask what law they need to know, and the Body of Knowledge answers in the indicators themselves.

II.A, data privacy laws. The four indicators ask you to understand how "transparency, choice, lawful basis and purpose limitation requirements apply to AI", how "data minimization and privacy by design requirements apply to AI", how "obligations on data controllers apply to AI", with examples that run from privacy impact assessments through cross-border transfers, data subject rights and automated decision making to incident management, and the "requirements that apply to sensitive or special categories of data (e.g., biometrics)". No statute is named; the concepts are those of the GDPR and the laws modeled on it.

II.B, other existing laws. Four kinds: intellectual property law, with the example of "prohibiting or limiting use of data for AI training"; nondiscrimination law "in the employment, credit, lending, housing and insurance contexts"; consumer protection law, "prohibiting unfair and deceptive acts or practices"; and product liability law, "prohibiting design and manufacturing defects".

II.C, AI-specific laws. Six indicators, and the structure is the EU AI Act's: the risk classification framework "(e.g., prohibited/high/limited/minimal risk)", the requirements around "risk management, data governance, technical documentation, conformity/impact assessments and record keeping", those around "human oversight, transparency and notification, and quality management", the "distinct requirements for general-purpose AI models", the "enforcement framework and penalties for noncompliance", and the "differences in requirements based on organizational context (e.g., providers, deployers, importers and distributors)". The domain description adds the South Korean AI Basic Law and US federal and state laws as further examples of current AI laws. The EU AI Act as the AIGP tests it takes the six indicators one by one.

II.D, standards and tools. Three indicators, three named sources: the OECD's "principles, framework, policies and recommended practices for trustworthy AI", the "NIST AI Risk Management Framework and Playbook (e.g., core functions, categories and subcategories)", and "the core ISO AI standards (i.e., 22989, 42001 and 42005)". Note the "i.e." on the ISO line: those three standards are the list, not examples from it. The NIST AI RMF as the AIGP tests it and The OECD AI Principles as the AIGP tests it cover the first two sources.

One caution on timing. The Body of Knowledge was approved in September 2025. The EU's amending regulation of July 2026, Regulation (EU) 2026/1744, changed parts of the AI Act's timetable after that date. The IAPP updates the exam annually and announces changes "at least 90 days before the new content appears in the exam", so until it does, the Body of Knowledge's framing stands and our lessons give the law as of the text they cite and say what has changed.

Reading the verbs

The most useful page in the document is the one most candidates skip. Under the heading "WHAT TYPES OF QUESTIONS WILL BE ON THE EXAM?" the Body of Knowledge says: "The performance indicators are guides to the depth of knowledge required to demonstrate competency. The verbs that begin the skill and task statements (identify, evaluate, implement, define) signal the level of complexity of the exam questions." The next page maps those verbs to Bloom's taxonomy and states where the exam sits: "IAPP exam questions mostly focus on the remember/understand and apply/analyze levels."

Here is how the 58 indicators begin, by domain.

Every indicator in Domain II begins with "Understand". On Bloom's pyramid as the Body of Knowledge prints it, that is the level whose verbs are "Classify, describe, discuss, explain, identify, locate, recognize, report, select, translate": a question that asks what a risk class is, which obligation falls on a deployer, or which standard covers a management system. Domains III and IV are led by doing verbs, "Govern", "Perform", "Conduct", "Document", "Establish", which sit at the apply and analyze levels: "Use information in new situations" and "Draw connection among ideas". Those are the scenario questions, where a situation is described and you choose what applies or what to do first. The study guide confirms the exam includes "case studies that present real-world challenges for AI model development and use".

That mapping is also the honest answer to how hard the exam is. The IAPP publishes no pass rate. What it publishes is the level: mostly remember, understand, apply and analyze, rarely evaluate or create. You are not asked to design a governance program from nothing; you are asked to recognize the right element and apply it to a case.

What changed in version 2.1

The exam information page lists three changes from the previous version:

• "Domain II.C was expanded to cover other AI legislation that has now been passed besides the EU AIA. The Domain II description was expanded to explain this expansion."
• "The term 'system' was included throughout the BoK where applicable when describing models and/or systems."
• "Examples were added to some performance indicators for clarity."

The first change is the one that affects study. Under version 2.0.1, II.C could be read as the EU AI Act alone; under 2.1, the domain description names the South Korean AI Basic Law and US federal and state laws as well, and II.C's indicators are written generically, as risk classification, requirements, oversight, general-purpose models, enforcement and roles, so that a question can ask them of a law other than the EU's; South Korea's AI Basic Act for the AIGP and US state AI laws as the AIGP tests them cover the two the description adds. The second change is small but tells you the exam distinguishes a model from a system, as the AI Act does. The third is the parentheses discussed above.

The IAPP's exam information page carries two editions of the document and tells you which to use: the 2.1 edition for anyone "testing on or after 2 February 2026". If you bought a study resource before 2026, check which edition it follows.

How the document changes

Two rules govern updates. The Body of Knowledge says: "Every year, the BoK is reviewed and, if necessary, updated. Changes are reflected in the annual exam updates and communicated to candidates at least 90 days before the new content appears in the exam." The handbook gives the scale: "Approximately 10% to 15% of the exam content is changed during annual updates."

For a candidate that means two things. First, the document you study from must be the one in force on your exam date, not the one that was current when you started. Second, a Body of Knowledge announcement is a 90-day clock: if the IAPP announces version 2.2 while you are studying, you have at least that long before the exam changes, and the announcement will say what moved.

Using it to study

The Body of Knowledge is a list, and a list is a checklist. The IAPP's own advice is to begin with it: the study guide's first step is "Review the body of knowledge", and the handbook says candidates "should judge exam preparedness by their thorough understanding of all topics on the body of knowledge rather than completion of any given training material."

Our course follows the document's own structure. Each of the 13 competencies is a content area in the AIGP exam guide, its lessons are mapped to the indicators, and every practice question in the app names the indicator it tests. How to study for the AIGP turns the blueprint's ranges into a 30-hour plan, and The AIGP exam: format, multi-select and the 300 explains how the ranges become a score. The first competency, I.A, is free in full with a free account.