We earn a commission if you buy through links on this page. How we're funded.
Quick answer
ISACA's AI certifications are AAIA (Advanced in AI Audit) and AAISM (Advanced in AI Security Management), now joined by AAIR (Advanced in AI Risk): advanced credentials for professionals who already hold a qualifying designation, such as CISA for AAIA or CISM or CISSP for AAISM. They certify your ability to audit, govern, and secure AI systems rather than build them, so they suit assurance, risk, and security specialists rather than engineers. If the AI side is what is new to you, DataCamp's Responsible AI Foundations is a six-hour, no-code primer on AI ethics, governance, security and risk to take before ISACA's own review material.
See Responsible AI Foundations on DataCamp →
This guide covers what each ISACA AI certification tests, the eligibility rules that catch people out, how the two differ, and when a different credential is the better use of your study time.
What are ISACA's AI certifications?
ISACA's AI certifications are advanced, experience-gated credentials that sit on top of its established professional certifications. ISACA is the association behind CISA (Certified Information Systems Auditor) and CISM (Certified Information Security Manager), and it has extended that family into artificial intelligence with two credentials aimed at different job functions, since joined by a third, AAIR (Advanced in AI Risk), for IT risk professionals.
All three share one exam shape — 90 multiple-choice questions in 150 minutes — and one price, set out below from ISACA's own credential pages.
The table below shows the fee and format of the three exams this page discusses, as ISACA publishes them. Where a course we score prepares for an exam, the Prep course column names the highest-scored one; the course prepares you, and only the vendor's exam awards the certification. Every other exam we track is compared on our AI certification exams page.
| Credential | Vendor | Level | Fee | Exam format | Enrol | Prep course |
|---|---|---|---|---|---|---|
| ISACA Advanced in AI Audit (AAIA) Requires an active CISA, or one of the audit and accounting designations ISACA lists (CIA, CPA and equivalents) with an IT audit or IT advisory focus. | ISACA | Advanced | $599 USD; $459 for ISACA members | 150 minutes · 90 questions · PSI test centre or remote | ISACA → | |
| ISACA Advanced in AI Security Management (AAISM) Requires an active CISM or CISSP. | ISACA | Advanced | $599 USD; $459 for ISACA members | 150 minutes · 90 questions · PSI test centre or remote | ISACA → | AI Risk Management for Security Managers Coursera → |
| ISACA Advanced in AI Risk (AAIR) Requires an active CISA, CISM, CRISC, CGEIT, CDPSE or one of the outside designations ISACA lists. | ISACA | Advanced | $599 USD; $459 for ISACA members | 150 minutes · 90 questions · PSI test centre or remote | ISACA → |
- AAIA (Advanced in AI Audit) is built for IT auditors who now have AI systems inside their audit universe.
- AAISM (Advanced in AI Security Management) is built for security managers who must secure AI systems and govern AI use across an organization.
ISACA also publishes shorter certificate-level AI training, which is the more sensible starting point if audit or security is not already your job.
What is the Advanced in AI Audit (AAIA) certification?
The Advanced in AI Audit certification tests whether an experienced auditor can plan and execute an audit of AI systems and the controls around them. AI audit is the practice of independently evaluating whether an AI system's data, models, and governance meet stated policies, regulations, and risk tolerances.
ISACA frames the exam around AI governance and risk, AI operations and technology, and the tools and techniques used to audit AI. Expect to be tested on:
- Model lifecycle controls: how a model is approved, versioned, monitored, retrained, and retired.
- Data provenance, lineage, and quality evidence, including consent and licensing for training data.
- Bias, fairness, and performance testing, and what acceptable evidence of testing looks like.
- Third-party and foundation-model risk, where the model is a vendor's black box rather than yours.
- Mapping controls to frameworks such as the NIST AI Risk Management Framework, ISO/IEC 42001, and the EU AI Act.
AAIA is not a machine learning exam. You are expected to understand enough about model behavior to ask an ML team the right questions and judge the answers.
What is the Advanced in AI Security Management (AAISM) certification?
The Advanced in AI Security Management certification targets security leaders who must secure AI systems and manage the program implications of AI adoption. ISACA positions it around AI governance and program management, AI risk management, and the controls that protect AI systems.
Subject matter includes threats traditional security programs never had to handle: prompt injection against LLM-powered applications, training-data poisoning, model extraction, insecure tool and plugin integrations, and shadow AI where staff paste sensitive data into consumer chatbots. It also covers acceptable-use policy, vendor assessment for model providers, and incident response when an AI system leaks data or produces harmful output. Like AAIA, AAISM certifies judgment about controls and policy rather than the ability to implement them in code.
Do you need CISA or CISM before taking an ISACA AI certification?
Yes, or a recognised equivalent: ISACA gates its AI credentials behind an existing designation. AAIA requires CISA, or an audit designation such as CIA, US CPA or ACCA held with an IT audit or advisory focus; AAISM requires an active CISM or CISSP. That is the biggest reason people are disappointed by these credentials, because you cannot simply register and sit the exam as you could for an entry-level cloud certification.
Eligibility rules and equivalent-experience routes change, so confirm current requirements on ISACA's credentialing pages before planning a study schedule. If you hold neither certification, earn the base credential first and treat the AI certification as a later specialization.
How hard are the AAIA and AAISM exams, and how should you prepare?
Difficulty depends more on your background than on raw AI knowledge: auditors struggle with the technical vocabulary, while technologists struggle with the control and evidence framing. A workable preparation sequence looks like this.
- Read the NIST AI Risk Management Framework and skim the EU AI Act risk tiers so the governance vocabulary is familiar.
- Work through ISACA's own review material, because ISACA exams reward its specific terminology.
- Get hands-on with one real system, such as a small retrieval-augmented generation app, so embeddings, grounding, and evaluation are concrete.
- Plan a few months of part-time study alongside work, and confirm current pricing and exam windows on the provider's page.
If the technical vocabulary is the gap, a short primer before ISACA's review material helps. The one we would start with is DataCamp's Responsible AI Foundations: four no-code courses, about six hours in all, on AI ethics, AI governance, AI security and risk management, and responsible AI data management. It is literacy, not exam preparation: it has no hands-on practice, does not use ISACA's terminology and does not replace the hands-on step above, so treat it as the warm-up before the review material and the real system.
Not sure this is the right one for you?
Tell the picker about your background and what you want the certificate to do, and it narrows the list to the one or two courses we would start with. It suggests only our affiliate partners’ courses, and says so before it suggests anything.
Try the AI Certification Picker →AAIA vs AAISM vs other AI governance certifications
The table below compares ISACA's AI certifications with the credentials most often considered alongside them.
The table below compares 6 certifications on best for, prerequisite and what it signals.
| Certification | Best for | Prerequisite | What it signals | Enrol |
|---|---|---|---|---|
| Advanced in AI Audit (AAIA) | IT and internal auditors | CISA, or CIA / CPA / ACCA with an IT audit focus | Can audit AI systems, data, and model controls | ISACA → |
| Advanced in AI Security Management (AAISM) | Security managers and CISO-track staff | Active CISM or CISSP | Can secure AI systems and govern AI adoption | ISACA → |
| Advanced in AI Risk (AAIR) | IT risk and compliance professionals | CISA, CISM, CRISC, CGEIT or CDPSE, or a listed outside designation such as CISSP, CIA or CRMP | Can recommend a response to AI risk across the business | ISACA → |
| IAPP Artificial Intelligence Governance Professional (AIGP) | Privacy, legal, and policy professionals | None stated | Understands AI law, policy, and governance programs | IAPP → |
| Microsoft Azure AI Fundamentals (now exam AI-901) | Beginners who need AI literacy quickly | None formally; AI-901 expects basic Python | Understands core AI and Azure AI service concepts | |
| AWS Certified AI Practitioner | Beginners in AWS-centric organizations | None | Understands generative AI concepts on AWS | AWS → |
For wider context, our AI certification comparison and the best AI certifications for 2026 place governance credentials next to technical ones.
Who should take an ISACA AI certification, and who should skip it?
Good fit
- CISA holders whose audit plan now includes AI models, AI vendors, or automated decision-making.
- CISM holders writing AI acceptable-use policy, assessing model vendors, or responding to shadow AI.
- Risk and compliance staff in regulated sectors such as finance, healthcare, and government.
Skip it if
- You do not hold a qualifying certification yet, in which case CISA or CISM comes first.
- You want to build AI systems, where a technical course or vendor certification serves you better.
- You are new to IT and want general AI literacy, which free beginner options cover well.
Do ISACA AI certifications expire?
ISACA credentials are maintained rather than permanent: holders pay an annual maintenance fee and log continuing professional education, and the AI credentials follow the same model. Because the underlying certification must stay active, letting a CISA or CISM lapse can put the AI credential at risk too. Confirm current CPE and renewal terms on ISACA's site before you register.
Are ISACA's AI certifications worth it?
ISACA's AI certifications are worth it for established audit and security professionals inside organizations that are actually deploying AI, and a poor choice for everyone else. The underlying demand is real: employers need people who can evidence that an AI system is controlled, and the U.S. Bureau of Labor Statistics Occupational Outlook Handbook continues to project strong growth for information security roles, which is where much of this work sits.
The honest caveat is novelty. AAIA and AAISM do not yet carry the recognition of CISA or CISM, and few job adverts name them, so their present value is knowledge and internal credibility rather than keyword matching. If you want a first AI credential instead of a specialization, an exam from the Microsoft credentials catalog is faster and better recognized; our guide to whether AI certifications are worth it explains how hiring managers read them, and our analysis of CompTIA's AI certification roadmap covers the vendor-neutral alternative still taking shape.
Ready to start?
Part of a DataCamp subscription, which unlocks the rest of its catalogue too. DataCamp's pricing page shows the plans and the price for your country.
Frequently asked questions
Does ISACA have an AI certification?
Yes. ISACA offers three advanced AI credentials: AAIA (Advanced in AI Audit) for auditors, AAISM (Advanced in AI Security Management) for security managers, and the newer AAIR (Advanced in AI Risk) for IT risk professionals.
All three extend ISACA's certification family into artificial intelligence, focusing on governing, auditing, and securing AI systems rather than building them. That framing is the important one: these are assurance credentials, aimed at people whose job is to evaluate whether an AI system is being run responsibly, not at people implementing it.
ISACA also publishes certificate-level AI training for professionals who want foundational knowledge without sitting an advanced exam, which is the accessible entry point given the eligibility gate on the advanced credentials. Check ISACA's own credentialing pages for current requirements before planning.
Do I need CISA before taking the AAIA exam?
In practice, yes, or a recognised audit equivalent. AAIA is open to CISA holders and to holders of CIA, US CPA, ACCA/FCCA, Canadian, Australian or Japanese CPA designations with an IT audit or advisory focus; AAISM requires an active CISM or CISSP.
That eligibility gate is why newcomers cannot start here, and it is worth understanding as design rather than obstacle. These credentials assume the audit or security management vocabulary is already yours and teach the AI-specific layer on top; without the base, the AI material has nothing to attach to.
Requirements and equivalent-experience routes are updated periodically, so check ISACA's credentialing pages before planning rather than relying on any summary. If you are not certified yet, earn CISA or CISM first — that is a substantial undertaking in itself and should be planned as its own project.
Is AAISM a technical certification?
AAISM is management-oriented rather than hands-on. You are expected to understand AI-specific threats such as prompt injection, data poisoning, and model extraction well enough to select and evaluate controls, not to implement them yourself.
Expect policy, risk assessment, vendor management, and incident response content. The competence being tested is judgement about whether a control is adequate and whether a vendor's assurances mean anything — which is a different skill from configuring the control, and is what a security manager is actually accountable for.
Engineers who want to secure AI systems in code will learn more from technical training and practical labs. The two are complementary rather than competing, and organisations generally need both — but taking the wrong one for your role is an expensive way to find that out.
How long does it take to prepare for an ISACA AI certification?
Plan on a few months of part-time study alongside full-time work, and experienced auditors or security managers often need less because the control vocabulary is already familiar.
The AI-specific material — model lifecycle risk, generative AI threats, what can and cannot be assured about a system you did not build — is usually the new part. Someone who has audited conventional systems for years is learning a new domain rather than a new discipline, which is a much shorter exercise.
Confirm current exam formats and scheduling on ISACA's site, since these details change between cycles. Because eligibility requires an existing certification, the honest total for someone starting from nothing is considerably longer than the preparation window for the AI exam alone.
Should I take an ISACA AI certification or a cloud AI certification?
Choose based on the work in front of you. If you audit or govern AI systems and already hold CISA or CISM, ISACA's credentials match your job. If you build, deploy, or support AI in a specific cloud, a vendor exam teaches platform skills you will actually use.
They are not competing answers to one question, because they certify different professions. The overlap people imagine — that both are "AI certifications" — is largely an artefact of the name; an auditor and a platform engineer share almost no daily tasks.
Governance and platform credentials complement each other rather than compete, and in larger organisations the people holding them work together closely. If you genuinely sit between the two roles, the deciding question is which one your next job title contains. Our cloud comparison covers the vendor side.