AIGP vs ISACA's AAIG, AAISM and AAIA

The IAPP's AIGP and ISACA's three AI credentials, the Advanced in AI Governance (AAIG), the Advanced in AI Security Management (AAISM) and the Advanced in AI Audit (AAIA), are often weighed against each other, and the comparison is simpler than the acronyms suggest. The AIGP is open to anyone and covers AI governance for every industry. ISACA's three are advanced credentials that sit on top of an existing one: the AAISM needs a CISM or CISSP, the AAIA a CISA or a listed accounting or audit designation, and the AAIG, still in a beta now closed to applicants, a CGEIT or six years of governance experience. ISACA also launched a fourth on April 15, 2026, the Advanced in AI Risk (AAIR), for IT risk professionals; AAISM vs AAIA vs AAIR sets ISACA's AI credentials side by side. This guide puts the AIGP beside the AAIG, AAISM and AAIA from the IAPP's and ISACA's own pages: who may sit each, what each covers, what each costs, how each is kept, and which fits which career.

The short answer

• The AIGP has no prerequisite and is "for professionals in all industries who need to understand and execute responsible AI governance."
• ISACA's three are add-ons. "AAISM candidates must hold an active CISM or CISSP certification." The AAIA is "Designed exclusively for professionals with CISA® or another qualified designation." The AAIG is for active CGEIT holders or those with "SIX YEARS OF ENTERPRISE GOVERNANCE EXPERIENCE, INCLUDING AT LEAST ONE IN AI".
• Subjects differ: governance across the AI life cycle (AIGP), enterprise AI governance for governance professionals (AAIG), AI security management (AAISM), AI audit (AAIA).
• Prices: the AIGP exam is US$649 or US$799; the AAISM and AAIA exams US$459 or US$599 plus a US$50 application fee; ISACA lists no AAIG price now that its beta has closed to applicants.
• The closest pair is the AIGP and the AAIG. The AAIG is in beta with its study materials "Coming soon!"; the AIGP's Body of Knowledge is in version 2.1 and every document around it is in print.

What each certification is for

AIGP. The IAPP's certification index: "Establish foundational knowledge of AI systems, their impacts and responsible principles and demonstrate an understanding how current and emerging laws apply to AI systems. AIGP is for professionals in all industries who need to understand and execute responsible AI governance." Its Body of Knowledge has four domains, the foundations of AI governance, how laws, standards and frameworks apply to AI, the AI development life cycle, and the deployment and use of AI systems, in 13 competencies and 58 performance indicators. The AIGP Body of Knowledge v2.1, explained walks through them.

AAIG. ISACA's page: "a vendor-neutral certification designed for experienced governance professionals tasked with leading AI adoption and key initiatives at the enterprise level." Its practice areas are "AI Enterprise Governance", "Data and AI Architecture Principles" and "AI Enterprise Integration and Performance Monitoring". It "is designed exclusively for experienced governance professionals who seek to demonstrate their ability to lead at the enterprise level, bridging AI innovation with trusted accountability."

AAISM. ISACA calls it "the first and only AI-centric security management certification designed to help experienced IT professionals reinforce the enterprise's security posture and protect against AI-specific threats." It is "designed to supplement certified security managers with the ability to identify, assess, monitor and mitigate risk associated with enterprise AI solutions", in three practice areas: "AI Governance and Program Management", "AI Technologies and Controls" and "AI Risk Management".

AAIA. "Be one of the first IT auditors and advisors to embrace AI and level up their careers with the new ISACA Advanced in AI Audit™ (AAIA™) certification." It "validates the leading-edge skills to advise on AI opportunities, assess and mitigate risks, ensure compliance and leverage AI to meet organizational strategic goals across three key domains: AI Governance and Risk AI Operations AI Auditing Tools and Techniques".

The word governance appears in all four, and means something different in each. In the AIGP it is the whole subject: the laws, frameworks, life cycle and deployment of AI. In the AAIG it is enterprise governance, the board's and the executive's oversight of AI, for people who already govern IT. In the AAISM it is one practice area of three, in service of security. In the AAIA it is one domain of three, in service of audit.

Who may sit each exam?

This is the sharpest difference. The IAPP sets no prerequisite for the AIGP: nothing in its handbook, FAQs or AIGP pages asks for a prior credential, a degree or years of experience, as AIGP certification requirements sets out. ISACA's three each require one.

• AAISM: "AAISM candidates must hold an active CISM or CISSP certification." The page's audience line adds "PROVEN EXPERIENCE IN SECURITY OR ADVISORY ROLES" and "SOME EXPERTISE ASSESSING, IMPLEMENTING AND MAINTAINING AI SYSTEMS".
• AAIA: "To qualify for AAIA, candidates must either hold a CISA certification or one of the following designations with an IT audit or IT advisory role focus: CIA, US CPA, ACCA or FCCA, Canadian CPA, Australian CPA or FCPA or the Japanese CPA designation." The page's full list runs further, to the ICAEW, CA ANZ, Hong Kong and Nigerian accounting bodies among others.
• AAIG: "ACTIVE ISACA CERTIFIED IN THE GOVERNANCE OF ENTERPRISE IT® (CGEIT®) HOLDERS OR SIX YEARS OF ENTERPRISE GOVERNANCE EXPERIENCE, INCLUDING AT LEAST ONE IN AI". When we first read the page, on October 21, 2026, it said four to six years.

So for a lawyer, a privacy professional, a product manager or a policy lead with no ISACA or ISC2 credential and no audit designation, the AAISM and AAIA are closed, and the AAIG is open only on the strength of six years of enterprise governance experience. The AIGP is open to all of them, which is both its reach and the reason it certifies foundations rather than advanced practice.

The four side by side

A few details behind the table. ISACA's exam registration gives "a six-month eligibility period to take their exam", with scheduling "as early as 48 hours after payment", at PSI test centers or by remote proctoring, except that "Residents of India, Mainland China, and Hong Kong" must test at centers. Passing is not the end: "To become AAISM certified, an individual must first meet the following requirements", which include the prerequisite credential, the exam, "Pay the US$50 application processing fee", and adherence to the Code of Professional Ethics and the Continuing Professional Education Policy, and "Candidates have five years from passing the exam to apply". The AAIA page states the same steps. For the AAIG, ISACA's page now reads "The AAIG Beta Application Period Is Now Closed" and "The AAIG beta program is in progress", and invites readers to "Join our mailing list for updates and information as we approach the full launch."

The IAPP's exam must be "scheduled and taken within one year of purchase", at Pearson VUE centers or by OnVUE, and the credential becomes active on passing only once membership or the maintenance fee is paid. What ISACA's pages do not give, and we therefore do not state, are the number of questions, the time allowed or the passing score for its exams; those are in its candidate guides, which we have not pinned. The AIGP's are public: 100 questions, 85 scored, 2.75 hours, 300 to pass on a 100 to 500 scale. The AIGP exam: format, multi-select and the 300 has them.

Accreditation and age

The AIGP is not ANAB-accredited: the handbook says "The IAPP AIGP, CDPO, CIPP/A and CIPP/C certifications are not accredited by ANAB but still follow the same rigorous policies and procedures to ensure they meet the same high standard of quality." ISACA's three pages say nothing about accreditation for the AI credentials, so no comparison can be drawn from the pinned pages.

Age is a real difference. ISACA describes the AAIA as "The World's First Advanced AI Audit Certification" and the AAISM as "the first and only AI-centric security management certification"; the AAIG is still in its beta program, now closed to applicants, with its review course, question database and manual all marked "Coming soon!". The AIGP's Body of Knowledge is at version 2.1, superseding 2.0.1, approved in September 2025 and effective in February 2026, with its handbook, study guide, practice exam, textbook and training all in print. For a candidate that means the AIGP's shape is known and the AAIG's is not yet.

Study materials: what each body gives away

ISACA's pages offer, for each of the AAISM and AAIA, a "Free AAISM Practice Exam" and "Free AAIA Practice Exam" of "12 free questions", alongside paid review courses, "a six-month subscription to a comprehensive 200+ question pool", review manuals in digital and print, and virtual workshops. The IAPP gives away the Body of Knowledge, the study guide with three example questions, the handbook and the Key Terms glossary, and sells a 100-question practice exam, training and a textbook; AIGP free resources: what costs nothing lists them. The IAPP's free documents are the fuller syllabus; ISACA's free quiz is the larger sample of questions.

Which AI certification is most valuable?

Neither body publishes a figure that would answer this, and the honest answer is by role. Best AI governance certifications in 2026 widens the field to GARP, PECB and IEEE.

• You hold a CISM or CISSP and run AI security: the AAISM is built for you, and the AIGP is not a security credential.
• You hold a CISA or an audit designation and audit AI systems: the AAIA.
• You hold a CGEIT or govern IT at enterprise level: the AAIG, when it leaves beta, is the ISACA credential aimed at you; the AIGP covers the same ground from the law and framework side and is available now.
• You have none of those, and work in privacy, law, policy, product or compliance: the AIGP is the one you can sit, and the one written for "professionals in all industries".
• You want the law: only the AIGP's Body of Knowledge names the EU AI Act, the NIST AI Risk Management Framework and the OECD principles as things to understand; ISACA's practice areas are framed as governance, controls, risk, operations and audit.

Holding one does not exclude another. An AIGP holder with a CISM could add the AAISM; a CISA with an AIGP could add the AAIA. Both bodies run continuing education policies that keep a credential active, the IAPP's at 20 hours a two-year term; Is the AIGP worth it? What the IAPP publishes weighs the AIGP on its own.

Where to start

If the AIGP is the open door, its first competency is the place to test it: AI and the need for governance is free in full with a free account, five lessons, 100 questions and 118 flashcards, read in the app. The rest of the course covers the 58 performance indicators with practice in the exam's format, flashcards and a mock in two halves. How to study for the AIGP: a 30-hour plan sets out the hours. If you hold a CISM or CISSP and work in security, start with our AAISM exam guide instead. If you hold a CISA or an audit designation and audit AI systems, start with our AAIA exam guide instead.