The short version
AAIR is ISACA’s exam on managing the risks of artificial intelligence inside an organization. It tests judgment more than memory: given a situation, which risk decision, control, or report is the best one? The exam has 90 multiple-choice questions, 150 minutes, and three domains, with the largest share (42%) on running an AI risk program. This guide is based on ISACA’s AAIR exam candidate guide and content outline, last read on October 18, 2026.
What the exam is
The full name is Advanced in AI Risk. ISACA describes the credential as a way to show you can identify and evaluate AI risk so that an organization can adopt AI responsibly. It is a risk credential, not an engineering one. You will not be asked to train a model or write code. You will be asked what a risk professional should do when a model drifts, when a vendor changes a model without notice, or when a regulator asks questions.
The credential is new, so there is little history to lean on. Study material from older exams will help with the risk vocabulary, but the AI-specific content is what sets this exam apart.
Who it is for
ISACA requires one of the listed qualifying designations to register for the exam. The list in the candidate guide includes CISA, CISM, CGEIT, CRISC, CDPSE, CISSP, CIA, CRMP, and several accounting and risk designations. Typical job titles in this space are IT risk manager, technology risk officer, GRC analyst, internal auditor moving into AI oversight, and privacy or compliance lead who now owns AI governance. The prerequisites page explains what the rules say and what to confirm with ISACA before you register.
Format at a glance
| Item | What ISACA says |
|---|---|
| Exam | Advanced in AI Risk (AAIR) |
| Questions | 90, multiple choice |
| Time | 2.5 hours (150 minutes) |
| Passing score | 450 on a scale of 200 to 800 |
| Languages | English, Spanish, Chinese |
| Delivery | Computer-based, at a PSI test center or remotely proctored |
| Retakes | Up to four attempts in a rolling 12 months, with waiting periods |
The exam format page goes through each of these in detail.
The three domains
| Domain | Weighting |
|---|---|
| 1. AI Risk Governance and Framework Integration | 37% |
| 2. AI Life Cycle Risk Management | 21% |
| 3. AI Risk Program Management | 42% |
Domain 1 is about the organization around the model: frameworks, ownership, policies, training, regulation, and ethics. Domain 2 follows a single AI system from design or purchase through training, testing, operation, and retirement. Domain 3 is the day-to-day risk craft: scenarios, treatments, controls, metrics, suppliers, and incident response. If you want a closer look at what each one asks of you, read domains explained.
How to approach it
Start by reading the content outline from ISACA, because it names every sub-area. Then spend your time in proportion to the weightings, with a slight bias toward your own gaps. Someone with a strong audit background usually needs more time on AI life cycle topics. Someone from a data science background usually needs more time on governance and regulation.
Questions often ask for the BEST or FIRST action, and several answers may look reasonable. Practice sets help you get used to that style. They do not replace ISACA’s own material or real experience with risk work.
More guides for AAIR
- AAIR Sample Questions With Answers
- Is the AAIR Exam Hard? An Honest Look
- AAIR Renewal and Retakes Explained
- Is AAIR Worth It? An Honest Look
- AAIR Cheat Sheet: Key Facts to Review
- AAIR vs AAISM: Which ISACA AI Exam First?
- AAIA vs AAIR: Which ISACA AI Exam First?
Next step
Check the specifics of the test on the exam format page, then plan your weeks with the study plan. When you want to test yourself, the AAIR practice exams are there, and they are a good fit after you have read the outline once.
Frequently asked questions
Is AAIR the same as CRISC?
No. CRISC is a separate ISACA credential on IT risk and controls, and it is one of the credentials that ISACA lists as a qualifying one for AAIR.
Does the exam require coding or machine learning skills?
No. You need to understand concepts such as drift, bias, and training data well enough to judge risk, but the exam does not ask you to build models.
Where do I check current rules?
On ISACA’s AAIR page. ISACA is the authority on eligibility, fees, and policies, and it can change them.