ISACA Advanced in AI Risk (AAIR) Practice Exam
ISACA Advanced in AI Risk (AAIR) Practice Exam
About the ISACA Advanced in AI Risk (AAIR) Exam
The ISACA Advanced in AI Risk (AAIR) certification is an advanced credential designed for experienced IT risk and governance professionals responsible for evaluating, governing, and managing risks associated with Artificial Intelligence technologies across the enterprise. The ISACA Advanced in AI Risk (AAIR) exam validates the ability to integrate AI risk governance into enterprise risk management programs while supporting responsible and secure AI adoption. The certification equips professionals with the expertise required to assess AI-related threats, evaluate impacts, oversee AI lifecycle risks, and establish governance frameworks that align with business, regulatory, and security objectives.
Key Focus
The certification focuses on practical AI risk management capabilities, including:
- AI governance and oversight
- AI lifecycle risk management
- AI risk assessment and treatment
- Regulatory and compliance alignment
- Ethical and responsible AI practices
- AI operational resilience and monitoring
- Enterprise AI risk integration
ISACA positions AAIR as a practice-driven certification that helps professionals guide organizations through emerging AI governance and risk challenges while safeguarding against financial, operational, regulatory, and reputational harm.
Who Should Pursue AAIR?
The certification is designed for experienced professionals involved in AI governance, technology risk management, and enterprise oversight, including:
- IT Risk Managers
- Governance, Risk and Compliance (GRC) Professionals
- Information Security Managers
- Cybersecurity Risk Professionals
- IT Auditors and Assurance Professionals
- AI Governance Specialists
- Enterprise Risk Managers
- Technology Risk Consultants
- Compliance and Regulatory Professionals
AAIR is intended for professionals with established experience in risk and governance functions and is positioned as an advanced-level credential rather than an entry-level AI certification.
Eligibility and Prerequisites
ISACA has designed AAIR for professionals who already possess experience in IT risk, governance, security, audit, or advisory functions.
Candidates are generally expected to hold qualifying professional certifications such as:
- CISA
- CISM
- CRISC
- CGEIT
- CDPSE
- CISSP
- CGRC
- CRMA
- PMI-RMP
- Other approved credentials
ISACA states that AAIR is intended to build upon existing governance and risk management expertise and extend those capabilities into AI-specific risk management practices.
Course Outline
The ISACA Advanced in AI Risk (AAIR) Exam covers the following topics -
Domain 1: AI Risk Governance and Framework Integration
- Types of AI models, frameworks, and business use cases
- AI governance fundamentals and organizational alignment
- AI-related roles, responsibilities, and RACI matrices
- AI acceptable use policy and policy development
- Compliance with AI laws, regulations, and legal exposure
- Bias, fairness, transparency, explainability, and trust
- Human rights, societal, and environmental impact of AI
Domain 2: AI Life Cycle Risk Management
- AI design, development, procurement, and documentation
- Data requirements, sourcing, validation, and quality
- Model training, testing, validation, and fine tuning
- AI deployment, robustness and scalability considerations
- Monitoring model drift and change management
- AI asset inventory and data classification
- Data security, privacy and minimization
- Decommissioning AI solutions
Domain 3: AI Risk Program Management
- AI threat landscape and threat modeling
- AI risk scenario development and classification
- AI risk assessment and treatment strategies
- AI control types, frameworks and validation
- AI risk metrics, monitoring and reporting
- AI vendor management and supply chain risk
- AI shared responsibility model and cloud computing risk
- AI incident response, BIA and disaster recovery
