AIGP Study Guide (2026): Free Notes, Plan & Practice
Last reviewed: · By Victor Humenhuk (AIGP certified, 2026)
What this guide is
This is a complete, free study guide for the IAPP's AI Governance Professional (AIGP) exam. I'm Victor Humenhuk - I passed AIGP in 2026 (along with CIPP/E and CIPP/US), and I built this site around the notes I actually used. Everything you need to pass sits here: 115 plain-English study notes organised into eight modules that mirror the AIGP body of knowledge, a free 28-question practice set, and an optional 229-question practice bank if you want more reps.
The notes are completely free - no email wall, no drip-fed PDF. One free account works across my AIGP, CIPP/E and CIPP/US sites, so if you're collecting IAPP certifications you only ever sign up once.
Use this page as your map: first understand how the exam works, then work through the modules in order, then follow the week-by-week plan and test yourself as you go.
How the AIGP exam works
Here are the facts about the exam itself, all verifiable on iapp.org:
| Item | Detail |
|---|---|
| Questions | 100 questions, multiple choice, including case-study scenarios |
| Time | 2.75 hours, with a 15-minute break offered |
| Passing score | 300 on a scale of 100-500 (IAPP is explicit that 300 does not mean 60%) |
| Scoring | Based solely on correctly answered scored questions - no penalty for wrong answers, no section minimums |
| Delivery | In person at Pearson VUE test centres worldwide, or online via OnVUE remote proctoring |
| Scheduling | Year-round; you must sit the exam within one year of purchase |
| Results | Immediate on screen - pass/fail plus your scaled score |
| Prerequisites | None. IAPP's handbook says so explicitly |
A few things worth knowing that IAPP does not publish: there is no official pass rate (I checked the FAQs, the candidate handbook and the certification pages - zero mentions), and IAPP won't even tell you how many questions you got right. Earlier candidate handbooks stated that a portion of questions are unscored items that don't count toward your result; the current split isn't restated on live pages, so check the current candidate handbook at iapp.org. Practically, it means one thing: if a question feels impossible, it may not even count - answer it and move on.
The body of knowledge, module by module
The AIGP body of knowledge covers a lot of ground - technology, ethics, frameworks, the EU AI Act, existing law, and the AI lifecycle. My notes split it into eight modules. Here's what each one covers and where to start.
Module 1: Foundations of AI. The technical bedrock: what AI actually is, how machines learn, and the model architectures the exam expects you to recognise. If you're from a legal or privacy background, this is where you'll spend extra time. Start with What is AI, then the four ways machines learn and the AI development life cycle - the lifecycle comes back in almost every later module.
Module 2: AI Impacts & Responsible AI. The harms and ethics module: who AI can hurt, the taxonomies used to classify harms, and what "trustworthy AI" actually requires. Key notes: the five harm targets, the trustworthy AI attributes and the OECD AI Principles.
Module 3: Governance & Risk Management. How organisations actually govern AI: structures, roles, culture, and the risk frameworks the exam loves - NIST AI RMF and ISO 42001 in particular. Start with the NIST AI RMF, the four roles in AI governance and calculating risk.
Module 4: AI Regulation. The EU AI Act, in depth - plus South Korea, the US and the rest of the world. This is the densest, most testable module: regulated roles, risk tiers, high-risk requirements, GPAI rules and penalties all reward precise recall. The three notes to master: the risk classification framework, the eight requirements for high-risk systems and general-purpose AI models.
Module 5: Existing Laws & AI. How pre-AI law applies to AI: GDPR, automated decision-making, intellectual property, non-discrimination, consumer protection and product liability. Privacy professionals will find this familiar territory. Start with GDPR and AI, Article 22 and the IP questions AI raises.
Module 6: Governing AI Development. Governance applied to the build phase: planning, data quality, impact assessments, risk-treatment strategies and testing. Key notes: impact assessments, the six risk strategies and testing and validation.
Module 7: Governing AI Deployment. What happens after launch: deployment choices, third-party and vendor risk, monitoring for drift, incidents - and agentic AI, which the current body of knowledge takes seriously. Start with agentic AI, third-party risk and monitoring, maintenance and drift.
Module 8: AI Governance Vocabulary. A cross-cutting glossary module. A surprising number of exam questions are really vocabulary questions in disguise, so treat this as a daily warm-up rather than a one-off read. Key notes: generative AI terms, model mechanics and performance and risks, security and harms.
A week-by-week study plan
This is the plan I'd give a friend with a full-time job: five weeks, roughly 8-10 hours a week. The method matters more than the calendar - every session should use active recall: read a note, close it, then write down its key terms and the one-line point of each from memory, and only then check yourself against the note. Reading feels like progress; retrieval is progress.
| Week | Focus | What to do |
|---|---|---|
| 1 | Foundations + harms | Work through all of Module 1 and Module 2. After each note, do the close-and-recall drill. End the week by explaining the AI lifecycle and the five harm targets out loud, from memory. |
| 2 | Governance + vocabulary | All of Module 3. Start using Module 8 as a 15-minute daily warm-up - pick one vocabulary note per day and self-test on it. |
| 3 | The EU AI Act | All of Module 4, slowly. Drill the four roles, the risk tiers and the eight high-risk requirements until you can list them cold. Mid-point check: take the free 28 practice questions and note which modules your misses came from. |
| 4 | Existing law + development | All of Module 5 and Module 6. Revisit whatever the week-3 practice run exposed. |
| 5 | Deployment + full practice | All of Module 7, then shift most of your time to the question bank. Review every wrong answer against the linked note. Re-read each module's hub page as a final sweep. |
Adjust freely: if you already hold a CIPP or work in AI, you can compress this to three or four weeks (Modules 1, 2 and 5 will go fast). If you're new to both the technology and the law, stretch it to six or seven and split week 1 into two. For the exam-week routine itself, see how to pass the AIGP.
Test yourself
Practice questions are where passing actually happens - they force retrieval, expose weak modules, and get you used to the exam's scenario style. The funnel on this site is simple:
- Start free. Take the 28 free practice questions - no card, no catch. Do this around week 3, once Modules 1-4 are in your head, and use the results to steer the rest of your revision.
- Then go deep. The full question bank has 229 questions - 129 practice questions mapped to the modules plus 100 exam-style questions including case-study scenarios. It's a one-time unlock with lifetime access, not a subscription, and it tracks which questions you've missed so your final week is spent on your actual weaknesses.
My rule of thumb from sitting the real thing: when you're consistently clearing 80% on the bank and can explain why each wrong option is wrong, you're ready to book.
Frequently asked questions
Do I need a privacy or technical background to take the AIGP?
No. IAPP's handbook is explicit that there are no prerequisites for the AIGP credential - no required experience, education or prior certification. The exam is designed to be passable from either direction: lawyers learn the technology in Modules 1 and 8, and technologists learn the law in Modules 4 and 5.
Is this study guide really free?
Yes. All 115 study notes, the module hub pages and the 28 practice questions are free with no email wall. The only paid thing on this site is the full 229-question bank, and that's a one-time purchase with lifetime access.
How many questions is the exam, and what do I need to pass?
100 multiple-choice questions (including case studies) in 2.75 hours, with a 15-minute break. You need 300 on a 100-500 scale, and IAPP states that 300 does not represent 60%. There's no penalty for guessing, so never leave a question blank.
How hard is the AIGP, honestly?
Moderate - it's broad rather than deep, and the breadth is what catches people. I've written up a full, honest answer in Is the AIGP exam hard?, including how long to study based on your background.