The IAPP AIGP Exam Body of Knowledge is the official outline of the knowledge and skills assessed on the Artificial Intelligence Governance Professional exam. The current version, 2.1, took effect on February 2, 2026. It covers four domains: AI governance foundations, laws and frameworks, development, and deployment. Use the outline to identify what to study, then practise applying its topics to realistic governance decisions.
What is the IAPP AIGP Body of Knowledge?
The AIGP Body of Knowledge, or BoK, describes the competencies and performance indicators candidates are expected to know. Competencies identify broad areas of professional knowledge. Performance indicators describe the tasks and abilities that demonstrate a candidate can use that knowledge.
The BoK also serves as the AIGP exam blueprint. It shows the minimum and maximum item counts for each domain and provides a detailed outline of the exam content. The counts are ranges, so they do not promise a fixed number of questions from every topic. Use the blueprint to understand domain coverage, and use the performance indicators to decide what you need to be able to explain or do.
IAPP states that the BoK is reviewed annually and, when it changes, candidates are notified at least 90 days before new content appears on the exam. Check the current official version when planning your study, especially if you have older notes or course materials.
What are the AIGP exam domains?
The current AIGP exam syllabus is organized into four domains. The official 2026 blueprint lists these minimum and maximum item counts:
| AIGP exam domain | Main focus | Minimum–maximum items |
|---|---|---|
| I. Foundations of AI governance | Principles, organizational expectations, policies, and lifecycle oversight | 16–20 |
| II. Laws, standards, and frameworks | Existing and AI-specific laws, standards, and governance tools | 19–23 |
| III. Governing AI development | Designing, building, training, testing, releasing, and maintaining systems | 21–25 |
| IV. Governing AI deployment and use | Deployment decisions, assessment, vendor risks, monitoring, and controls | 21–25 |
These are the ranges printed in the blueprint, not percentages. All four domains are part of the IAPP AIGP exam content. The current document identifies itself as version 2.1, effective February 2, 2026, superseding version 2.0.1.
Domain I: Understanding the foundations of AI governance
Domain I covers what AI is, why it needs governance, and how organizations set expectations for responsible use. Study common definitions and types of AI, along with the risks and harms AI systems can create for individuals, groups, organizations, and society.
The domain includes AI characteristics that can make oversight difficult, such as complexity, opacity, autonomy, speed, scale, dependence on data, and probabilistic outputs. It also covers responsible AI topics such as fairness, safety, reliability, privacy, security, transparency, explainability, accountability, and human-centeredness.
Candidates should understand how to establish governance roles, communicate responsibilities, train stakeholders, and adapt governance to an organization’s size, maturity, industry, services, and risk tolerance. Policies and procedures should apply across the AI lifecycle, from use-case assessment and data acquisition to development, testing, deployment, monitoring, documentation, and incident management.
For example, a company using AI to screen job applications should define who approves the use, who assesses discrimination risks, and who handles complaints. The governance process should include documented controls and review, rather than relying on a general statement that the system is fair.
Domain II: How laws, standards, and frameworks apply to AI
The AIGP exam topics include laws written specifically for AI and existing laws that may apply when organizations develop or use AI. The goal is to understand the major obligations and recognize when a use case may raise legal or compliance concerns; the BoK is not a requirement to memorize every rule in every jurisdiction.
Privacy-related knowledge areas include transparency, choice, lawful basis, purpose limitation, data minimization, privacy by design, data subject rights, cross-border transfers, and the use of third-party processors. The domain also addresses intellectual property, consumer protection, product liability, and nondiscrimination laws, including contexts such as employment, lending, housing, credit, and insurance.
For AI-specific laws, study risk classification, data governance, technical documentation, impact assessment, human oversight, transparency, quality management, enforcement, and how responsibilities can differ for providers, deployers, importers, and distributors. The blueprint gives examples including the EU AI Act, South Korea’s AI Basic Law, and U.S. federal and state AI laws applicable to private-sector organizations.
The standards and frameworks portion includes OECD principles and practices for trustworthy AI, the NIST AI Risk Management Framework and Playbook, and core ISO AI standards 22989, 42001, and 42005. Learn the purpose of these resources and how they can support an organization’s governance program. Since laws and guidance can change, check current official materials while preparing.
Domain III: Understanding how to govern AI development
Domain III follows an AI system through design, development, training, testing, and release. Candidates should know how governance applies when an organization defines a use case, selects an approach, designs a system, acquires data, trains and tests models, and prepares for production.
The outline includes impact assessments, ethical considerations, risk identification, stakeholder feedback, documentation, and operational controls. Data governance topics include verifying rights to collect and use data, assessing whether the data is fit for its purpose, and documenting data quality, integrity, lineage, and provenance.
Testing may address performance, security, bias, interpretability, and validation. Before release, teams should assess readiness and prepare relevant documentation, such as a model card where applicable. After release, they should monitor performance, reliability, and safety; investigate incidents; and schedule maintenance, updates, or retraining.
A useful way to study AIGP AI development governance is to follow a system from its proposed use case through training and testing. At each stage, ask what could go wrong, what evidence should be recorded, and who is responsible for reviewing or addressing the risk.
Domain IV: Understanding how to govern AI deployment and use
Deployment governance starts with the use case and the conditions in which the system will operate. The domain covers differences among AI models and deployment options, including proprietary and open-source models, cloud and on-premises hosting, and use of a model as-is or with fine-tuning, retrieval-augmented generation, or agentic architectures.
Candidates should understand how to assess risks before deployment. This can include reviewing an impact assessment, examining vendor and licensing terms, and recognizing that an organization using its own proprietary model may face different responsibilities from one using a third-party tool.
Governance continues after the system goes into use. Organizations should have policies, user training, monitoring, incident management, and regular reviews of performance, reliability, and safety. They should consider unintended or secondary uses, plan communications with affected stakeholders, and have a way to deactivate or restrict a system when necessary. These are key AIGP AI assessment topics as well as deployment responsibilities.
What does the AIGP exam test beyond memorization?
The performance indicators begin with action verbs such as identify, understand, evaluate, apply, and implement. These verbs indicate the expected level of understanding. Remembering a term is useful, but candidates should also be ready to apply governance concepts to a situation and evaluate what action fits the facts.
IAPP says its exam questions mostly focus on the remember/understand and apply/analyze levels. The official study guide describes a three-hour exam with 100 multiple-choice items, including case studies about real-world AI development and use. It shows both single-answer and multi-select question examples. Follow the instructions in each question carefully, particularly when it specifies how many options to select.
For more practice with question styles, read our guide to AIGP Certification Question Formats.
How to use the AIGP exam blueprint to prepare
Use the BoK as a checklist rather than as a reading list to memorize once. For each performance indicator, mark whether you can explain it, apply it to a scenario, or need more study.
A practical preparation sequence is:
- Review all four AIGP exam domains and mark each topic as familiar, partly familiar, or new.
- Use the blueprint ranges and your own knowledge gaps to set priorities. Give more time to development and deployment if those areas are less familiar, but do not skip a domain.
- Study concepts in context. Ask what decision a governance professional would make, what evidence they would need, and who should be involved.
- Practise scenario questions. Explain why an answer fits the facts and why the other choices do not.
- Recheck the current version of the outline before the exam, particularly if your materials were prepared before February 2026.
IAPP’s study guide suggests planning for a minimum of 30 hours of preparation, while noting that the time needed depends on your experience and choices. Treat that as a starting point, then adjust your study plan based on practice results and the topics you find difficult.
AIGP Body of Knowledge FAQs
Is the Body of Knowledge the basis for the exam?
Yes. IAPP describes the BoK as an outline of subject matter covered by the exam. Its performance indicators specify the skills and knowledge that questions assess.
Does the AIGP exam cover AI laws and regulations?
Yes. Domain II covers existing laws that may apply to AI, AI-specific legal requirements, and differences in responsibilities across roles in the AI ecosystem.
Does the exam cover AI governance and risk management?
Yes. Governance and risk management topics appear across the domains. They include organizational policies, impact assessments, risk identification, controls, monitoring, and incident management.
Does the AIGP exam cover development and deployment?
Yes. Domain III addresses governing development, testing, and release. Domain IV focuses on assessing, deploying, and responsibly using AI systems.
Which topics should I study most?
Use the item ranges and your own assessment together. Domains III and IV have the highest minimum ranges, but all four domains are testable. Review the performance indicators to identify the topics you cannot yet explain or apply.
What is the current AIGP Body of Knowledge version?
Version 2.1, effective February 2, 2026. Confirm the current version on IAPP’s certification page before using older study materials.
Ready to Start Your AIGP Certification Journey?
Contact our team for AIGP certification online training, study resources, practice questions, and exam preparation support.
Contact UsBegin with the current outline, then focus your study on performance indicators you cannot confidently apply to a realistic scenario. Download and review the official IAPP AIGP study guide (PDF) as your next step.