AIGP vs CIPP/E, CIPP/US and CIPM: which first

The AIGP, the CIPP/E, the CIPP/US and the CIPM are four exams from one body, the IAPP, and the choice between them is a choice about your work, not about which is better. One certifies AI governance across every industry; two certify privacy law for a region; one certifies running a privacy program. This guide puts the four side by side from the IAPP's own pages for each, the store's listings, and the Certification Candidate Handbook that governs all of them: what each covers, how the exams compare, where the AIGP's syllabus overlaps with the privacy exams, what holding two of them unlocks, and how to decide which to sit first.

The short answer

• The AIGP certifies AI governance: "AIGP is for professionals in all industries who need to understand and execute responsible AI governance."
• The CIPP/E and CIPP/US certify privacy law for a region, Europe and the United States; the CIPP is "the premier global credential for privacy and data protection", with six regional concentrations.
• The CIPM certifies running a privacy program: "CIPM is for global professionals responsible for integrating privacy requirements into business operations."
• The exams differ in size and price: the AIGP is 100 questions in 2.75 hours for US$649 or US$799; each of the other three is 90 questions in 2.5 hours for US$550, member or not. All four pass at 300 on the same scale.
• Take first the one your work is about. A CIPP and the AIGP together, with three years of privacy experience, qualify you to apply for the Fellow of Information Privacy.

What does each certification cover?

The IAPP describes each on its certification page, and the descriptions are the clearest statement of what you would be buying.

AIGP. The certification index says: "Establish foundational knowledge of AI systems, their impacts and responsible principles and demonstrate an understanding how current and emerging laws apply to AI systems." The store's description of the exam: "The AIGP exam assesses knowledge of responsible and ethical development, deployment and management of AI systems to ensure safety and trust." Its Body of Knowledge has four domains: the foundations of AI governance, how laws, standards and frameworks apply to AI, the AI development life cycle, and the deployment and use of AI systems. It is the only one of the four whose subject is not privacy.

CIPP/E. "The ANAB-accredited CIPP/E designation proves you have an understanding of pan-European and national data protection laws, key privacy terminology and practical concepts concerning the protection of personal data and trans-border data flows." The IAPP's own training for it is described as "delivering comprehensive knowledge of the EU General Data Protection Regulation to ensure compliance and data protection success in Europe", which says what the exam is about in one phrase: the GDPR, and the European law around it. Its Body of Knowledge and its exam exist in French and German as well as English.

CIPP/US. "The CIPP/US credential proves you have a strong understanding of U.S. privacy laws and regulations. The ANAB-accredited CIPP/US certification is a key industry benchmark among top employers, and the global gold standard for privacy professionals." The store: the exam "assesses knowledge of U.S. privacy laws and regulations and legal requirements for transferring sensitive personal data to/from the United States, the EU and other jurisdictions", and the training for it steers "privacy pros through the interconnected web of federal and state laws governing U.S. data privacy." There is no single U.S. privacy statute, so the CIPP/US is a map of many.

CIPM. "The ANAB-accredited CIPM designation says that you are a leader in privacy program administration and equipped with the knowledge to establish, maintain and manage a privacy program across all stages of its life cycle." Where the CIPPs test law, the CIPM tests operations: the store says the exam "assesses understanding of the skills to establish, maintain and manage a privacy program across all stages of its operational life cycle." It is offered in English, German, French, Chinese and Brazilian Portuguese.

The CIPP is a family: "The IAPP offers six distinct CIPP designation concentrations, demonstrating mastery in privacy laws, regulations and frameworks for the specific regions of Asia, Australia, Canada, China, Europe and the U.S." The CIPP/E and CIPP/US are the two this guide compares because they are the two the AIGP is most often weighed against.

The four exams side by side

The figures are the store's: each listing says the exam "must be completed within one year of purchase", and the three privacy exams carry the same price in both columns, where the AIGP's member price is US$150 lower than its non-member price. The FAQs' chart of every exam gives the same counts: 100 questions and 2.75 hours for the AIGP, 90 questions and 2.5 hours for each CIPP, the CIPM and the CIPT. What the AIGP exam costs in 2026 works through the AIGP's membership arithmetic.

What the four share is the handbook. All are scored the same way: "all raw scores (i.e., the number of questions answered correctly) are converted to a common scale ranging from 100 to 500. The passing score for all IAPP exams is 300 (which does not represent 60%)." All are maintained the same way, with the US$250 certification maintenance fee for two years or the US$295 annual membership, and 20 continuing education credits a year. All are standalone: "IAPP certifications are standalone credentials. Official training courses help you study for exams. However, exam questions do not correspond directly to training materials." And all come with the same advice on preparation, a minimum of 30 hours of study, which the FAQs give for every exam.

The accreditation row is the one real difference in status. The handbook: "The IAPP CIPP/E, CIPP/US, CIPM and CIPT credentials are accredited by the American National Standards Institute National Accreditation Board under the International Organization for Standardization standard 17024:2012." And: "The IAPP AIGP, CDPO, CIPP/A and CIPP/C certifications are not accredited by ANAB but still follow the same rigorous policies and procedures to ensure they meet the same high standard of quality." If an employer or a tender asks for an ANAB-accredited credential by name, the three privacy exams meet that test today and the AIGP does not.

Is the CIPP harder than the AIGP?

The IAPP publishes no pass rate for any exam, so nothing can be said about which more people fail. What can be compared is the shape. The AIGP is the longer sitting, 100 questions against 90 and 2.75 hours against 2.5, and its study guide's example questions include a multi-select in the form "select 3 of the 5 options below", with no partial credit. How hard is the AIGP exam? goes through what makes it hard in practice: the breadth of Domain II's law and the depth the Body of Knowledge's verbs ask for.

The subject matter decides the rest. A lawyer who works in the GDPR every day will find the CIPP/E a test of what they know; the same lawyer will find the AIGP's Domain III, the AI development life cycle, and Domain IV, deployment and use, new ground. A machine learning engineer will find the reverse. Difficulty here is distance from your own work, which is also the best reason to choose the exam that is about your work.

Where the AIGP overlaps with the privacy exams

The AIGP is not a privacy exam, but its Body of Knowledge contains one privacy competency and one governance competency that a CIPP or CIPM holder will recognize.

II.A, "Understand how existing data privacy laws apply to AI", carries 4 to 6 of the 85 scored questions. Its indicators read like a CIPP syllabus turned toward AI: "Understand how transparency, choice, lawful basis and purpose limitation requirements apply to AI." "Understand how data minimization and privacy by design requirements apply to AI." "Understand how obligations on data controllers apply to AI (e.g., regarding privacy impact assessments, use of third-party processors, cross-border data transfers, data subject rights, automated decision making, incident management, breach notification and record keeping)." "Understand the requirements that apply to sensitive or special categories of data (e.g., biometrics)." A CIPP/E holder has studied every one of those concepts; the AIGP asks how they apply when the processing is a model.

I.B and I.C, "Establish and communicate organizational expectations for AI governance" and "Establish policies and procedures to apply throughout the AI life cycle", are the AIGP's program-building competencies, and a CIPM holder who has built a privacy program has built the same kind of thing for a different subject. The AIGP's Domain IV, deployment and use, is where the two part: monitoring a deployed system, incidents and decommissioning are AI matters without a privacy equivalent.

The overlap runs one way. The AIGP's privacy competency is 4 to 6 questions out of 85; the CIPP/E is 90 questions of European law. Holding the AIGP does not prepare you for a CIPP, and holding a CIPP prepares you for about a fourteenth of the AIGP.

Which should you take first?

The IAPP's descriptions answer this by role, and so does the Body of Knowledge:

• Your work is privacy law in Europe, as counsel, a DPO or a compliance lead: the CIPP/E first. It is the credential for the GDPR, and the AIGP's II.A will then be the easy part of a later AIGP.
• Your work is privacy law in the United States: the CIPP/US first, for the same reason.
• You run or are building a privacy program: the CIPM first; the AIGP's I.B and I.C will be familiar when you come to them.
• Your work is AI, as a product owner, an engineer, a risk or audit lead, or counsel advising on AI systems: the AIGP first. Nothing in the privacy exams covers Domains III and IV, and the AIGP is the only one of the four whose Body of Knowledge names the EU AI Act, the NIST AI Risk Management Framework and the OECD principles.
• Your work is both, privacy today and AI governance arriving: take the privacy exam that matches your region first, because it is the credential your current role is measured by, and the AIGP second, because II.A will already be known.

Is the AIGP worth it? What the IAPP publishes weighs the AIGP on its own terms; this guide only puts it beside its siblings.

Holding two: the Fellow of Information Privacy

Two of the four together open a designation. The FAQs: "This credential is for professionals who hold a CIPP and either a CIPM, CIPT or AIGP credential." The handbook sets the full requirements for the Fellow of Information Privacy: "An active CIPP certification: CIPP/A, CIPP/C, CIPP/CN, CIPP/E or CIPP/US." "An active AIGP, CIPM or CIPT certification." "Three years of continuous work experience in which data privacy represents at least 50% of the candidate's job responsibilities." Then "A reference list of three peers" and "A personal statement explaining how the candidate's background qualifies them for a FIP designation." An information security certification "from ISC2, ISACA, IEEE or other professional institution will satisfy one year" of the experience requirement.

So the AIGP counts, alongside the CIPM and CIPT, as the second credential of the pair; the first must be a CIPP. "The certificant's only requirement for maintaining the FIP designation active is to keep their core designations in good standing." For someone choosing an order, that settles it in one case: if the FIP is the goal, a CIPP is required and the AIGP is one of three ways to complete the pair.

One practical note for the second exam: every store listing, the AIGP's included, asks at purchase "Have you ever attempted the AIGP exam before OR are you a holder of any other IAPP certification?", with its own exam's name, because the FAQs promise a lower price: "If you currently hold an IAPP certification, any additional first-time certification exams will receive a discounted price." The store's pages show the standard prices; the discounted one appears when you answer yes.

Studying for the AIGP after a privacy exam

A CIPP or CIPM holder studying for the AIGP can spend the 30 hours unevenly: II.A needs a reading, not a course; Domains III and IV need the course. How to study for the AIGP: a 30-hour plan weights the hours by the blueprint's ranges, and The AIGP Body of Knowledge v2.1, explained shows the ranges by competency.

Our AIGP course is written to the 58 performance indicators, with practice in the exam's format, flashcards and a mock in two halves. The first competency, AI and the need for governance, is free in full with a free account: five lessons, 100 questions and 118 flashcards, read in the app. For a privacy professional it is the right place to test the distance: the foundations of AI are the part of the AIGP that no privacy exam has covered.