Three names keep turning up beside the AIGP when people choose an AI governance credential: ISO 42001, in the form of a Lead Implementer or Lead Auditor credential, and GARP's Risk and AI certificate, the RAI. They are often compared as if they did the same job. They do not. The AIGP certifies knowledge of AI governance as a field, with the law at its center. An ISO/IEC 42001 credential certifies that you can build or audit one kind of management system against one standard. The RAI certifies knowledge of AI risk for risk professionals. This guide sets the three side by side from their bodies' own documents, then answers the question in the title: which to take first, for which job.
The short answer
- The AIGP is the broad credential: no prerequisite, 100 questions in 2.75 hours with a 15-minute break, taken when you choose within a year of buying it, US$649 or US$799.
- An ISO/IEC 42001 credential from PECB comes with a course: the exam is on the fifth day, 80 questions in three hours, 70% to pass. The full Lead Implementer or Lead Auditor grade then needs five years of experience, two of them in AI, and 300 hours of project or audit work.
- GARP's RAI is a fixed-window exam: 80 multiple-choice questions in four hours, in April or October, after an expected 100 to 130 hours of study, USD 650 to 750 for non-members.
- Which first: the AIGP if you need the whole field and its law; the Lead Implementer or Lead Auditor if your organization is building or auditing an ISO/IEC 42001 management system; the RAI if you work in financial or enterprise risk.
What each one certifies
The AIGP. "AIGP is for professionals in all industries who need to understand and execute responsible AI governance", says the IAPP's certification index. The store page describes the exam: it "assesses knowledge of responsible and ethical development, deployment and management of AI systems to ensure safety and trust." Its Body of Knowledge runs across four domains: the foundations of AI governance, how laws, standards and frameworks apply to AI, governing AI development, and governing AI deployment and use.
ISO/IEC 42001 Lead Implementer. PECB's scheme: "The “ISO/IEC 42001 Lead Implementer” credential is a professional certification for individuals aiming to demonstrate competence in implementing an AIMS and leading an implementation team." The AIMS is the artificial intelligence management system, and the scheme describes the standard behind it: "ISO/IEC 42001 specifies the requirements for establishing, implementing, maintaining, and continually improving an artificial intelligence management system (AIMS)."
ISO/IEC 42001 Lead Auditor. "The “ISO/IEC 42001 Lead Auditor” credential is a professional certification for individuals aiming to demonstrate the competence to audit the artificial intelligence management system and lead an audit team." Its course teaches candidates to "Plan, conduct, and close an ISO/IEC 42001 compliance audit, in accordance with ISO/IEC 17021-1 requirements, ISO 19011 guidelines, and other best practices of auditing".
GARP's RAI. GARP's page says the "RAI Certificate provides comprehensive coverage of relevant tools and techniques including generative AI, AI risks and risk factors, responsible and ethical AI, and governance frameworks for ensuring AI is deployed effectively and responsibly within organizations." Its topics are "AI and Risk: Intro and Overview", "Tools and Techniques", "Risks and Risk Factors", "Responsible and Ethical AI" and "Data and AI Model Governance".
AIGP vs ISO 42001: field or standard
The AIGP's Body of Knowledge includes ISO/IEC 42001, as one standard among several. Competency II.D asks candidates to "Understand the core ISO AI standards (i.e., 22989, 42001 and 42005)", alongside the OECD's principles and the NIST AI Risk Management Framework, and the rest of Domain II covers the laws: privacy law applied to AI, other existing laws, and AI-specific laws such as the EU AI Act. An AIGP holder is expected to know what ISO/IEC 42001 is for and how it relates to the rest of the field.
A PECB credential goes the other way: deep into one standard. The Lead Implementer exam covers six domains, from "Fundamental principles and concepts of an artificial intelligence management system (AIMS)" to "Continual improvement and preparation for an AIMS certification audit"; the Lead Auditor covers seven, ending with "Managing an ISO/IEC 42001 audit program". Both courses end on the audit, because that is the purpose of a management system standard: an organization can be audited against it by a third party. The Lead Implementer's fourth day covers "preparation for the certification audit", and its page lists, among the learning objectives, to "Prepare an organization to undergo a third party certification audit"; the Lead Auditor's fourth day is the "Closing of the audit".
That gives the short version of the difference. The AIGP is the map, and an ISO/IEC 42001 credential is one road on it, traveled in detail. Someone searching for an ISO 42001 certification for individuals is looking for the second; someone who must advise on the EU AI Act, set an AI policy and judge a vendor's model needs the first.
The exams side by side
| AIGP (IAPP) | ISO/IEC 42001 Lead Implementer (PECB) | ISO/IEC 42001 Lead Auditor (PECB) | RAI (GARP) | |
|---|---|---|---|---|
| Questions | 100 | 80 | 80 | 80, multiple choice |
| Time | 2.75 hours, with a 15-minute break | 3 hours | 3 hours | 4 hours |
| To pass | 300 on a scale of 100 to 500 | 70% | 70% | Pass or fail |
| When | Any time within one year of purchase | Day 5 of the course | Day 5 of the course | April or October |
| Before the exam | No prerequisite | General knowledge of ISO/IEC 42001 | A fundamental understanding of ISO/IEC 42001 | None stated |
| For the full credential | Nothing more | Five years' experience, two in AI; 300 project hours | Five years' experience, two in AI; 300 audit hours | Nothing more |
| Cost | US$649 members, US$799 non-members | In the course price | In the course price | USD 650 to 750 for non-members |
| Results | Immediate, "unless otherwise communicated" | Not on the pages read | Not on the pages read | Four to six weeks after the window closes |
A few details behind the table. The AIGP's "passing score for all IAPP exams is 300 ( which does not represent 60% )", in the FAQs' words, so the three figures in that row are not comparable. PECB's experience requirements are graded: passing the exam alone opens a Provisional Implementer or Provisional Auditor credential with no experience, and an Implementer or Auditor grade needs two years with one in AI and 200 hours. For the RAI, GARP's fees page lists three tiers in each window: USD 525 or 625 for FRM, RAI and ERP holders, USD 550 or 650 for individual members, and USD 650 or 750 for non-members, the lower figure for early registration.
Keeping each credential
The AIGP runs on a two-year term. The holder must "meet the minimum CPE requirements and either pay their certification maintenance fee (CMF) of USD250 for a certification term or become an IAPP member for USD295 annually", as the FAQs put it, with 20 continuing education credits a term.
PECB's scheme says "PECB certifications are valid for three years." Holders "are required to pay an Annual Maintenance Fee (AMF) and submit the Continuing Professional Development (CPDs)", and they report the auditing or implementation work they have done, "including the contact details of the individuals who can validate these tasks."
GARP asks less: "Once you're an RAI Certificate Holder, you are then strongly encouraged to participate in GARP’s Continuing Professional Development (CPD) program to help stay up-to-date with the latest best practices in risk management."
AIGP vs GARP RAI
The RAI and the AIGP overlap more in subject than the ISO credentials do, and differ more in form.
On subject, the RAI leans toward the technology and its risks, with "Tools and Techniques" and "Risks and Risk Factors" as topics and governance as one of five. The AIGP leans toward the law and the organization: Domain II alone carries 19 to 23 questions on how laws, standards and frameworks apply to AI, and Domains III and IV ask how to govern the development and deployment of a system.
On form, the RAI is a fixed event. You register for a window, GARP gives you its curriculum and a practice exam, you study for an expected 100 to 130 hours, and you learn the result weeks later. The AIGP is on demand. The IAPP recommends "a minimum of 30 hours of study time", sells its training and practice exam separately, and gives the result at the end of the exam.
For a risk professional in financial services the RAI's framing is the more familiar one. For anyone whose work is policy, privacy, legal or product, the AIGP's is.
Which should you take first?
- You are new to AI governance and come from privacy, legal, compliance or policy: the AIGP. It has no prerequisite, covers the whole field, and gives you the vocabulary the others assume, including what ISO/IEC 42001 is for.
- Your organization is implementing ISO/IEC 42001 or seeking certification against it: the Lead Implementer if you will build the management system, the Lead Auditor if you will audit it. If you also own the program's policy and legal side, the AIGP first gives the context; the PECB course then goes deep.
- You audit management systems already: the Lead Auditor, whose course teaches the audit "in accordance with ISO/IEC 17021-1 requirements, ISO 19011 guidelines, and other best practices of auditing".
- You work in financial or enterprise risk: the RAI, if its windows and hours fit; the AIGP adds the law, which the RAI covers less.
- You will need two: take first the one your employer, client or tender asks for. If none asks, the broad credential first and the specialist one second is the order in which the knowledge builds.
Studying for more than one
The overlap between the three is real but partial.
ISO/IEC 42001 is one line in the AIGP's competency II.D, so an AIGP candidate learns what the standard is for and where it sits beside the law and the other frameworks, not its clauses. PECB's exams start where the AIGP stops: the Lead Implementer's first two domains are the "Fundamental principles and concepts of an artificial intelligence management system (AIMS)" and the "Artificial intelligence management system requirements", and four more follow on planning, implementing, monitoring and improving it. An AIGP holder arrives at a PECB course knowing the context and little of the detail.
The RAI and the AIGP share more ground. The RAI's "Responsible and Ethical AI" topic sits close to the AIGP's competency I.A, which asks candidates to "Identify and apply the common principles of responsible AI", and its "Data and AI Model Governance" topic sits close to competency III.B, which begins "Establish and follow the requirements for data governance". The RAI goes further into techniques and model risk; the AIGP goes further into the law.
The forms differ more than the content. A PECB exam comes at the end of a course, the RAI at the end of months of study for a fixed window, and the AIGP whenever you book it. So study one at a time: the shared material carries over from one to the next, and each exam's technique has to be practiced on its own.
Where to start
If the AIGP comes first for you, its first competency is free in full with a free account: AI and the need for governance, five lessons, 100 questions and 118 flashcards. The rest of the course covers the other 12 competencies, ISO/IEC 42001's place in Domain II among them, with practice in the exam's format. Best AI governance certifications in 2026 compares the wider field, ISACA's credentials and IEEE's included, and The NIST AI RMF as the AIGP tests it covers the framework most often set beside ISO/IEC 42001.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.