AAIR vs AAISM: Which ISACA AI Exam First?

The short version

Take AAIR if your job is risk, audit, or advisory work and you need to judge AI risk. Take AAISM if your job is security management and you need to protect AI systems. Both are advanced ISACA exams with 90 questions and 150 minutes, so the choice is about role, not difficulty. If your work spans both, take the one that matches your current qualifying credential first, then decide on the second. This comparison uses ISACA’s pages and candidate guides, checked on October 22, 2026.

Side by side

	AAIR	AAISM
Full name	Advanced in AI Risk	Advanced in AI Security Management
Focus	Managing AI risk	Securing and governing AI
Audience	Risk, audit, and advisory professionals	Security professionals and managers
Qualifying credential	An active CRISC or another listed designation, such as CISA, CISM, CGEIT, CDPSE, or CISSP	Active CISM or CISSP
Questions and time	90 multiple choice, 150 minutes	90 multiple choice, 150 minutes
Passing score	450 on a 200 to 800 scale	450 on a 200 to 800 scale
Languages in the candidate guide	English, Spanish, Chinese	English, Spanish, Japanese
Domains	Three, weighted 37%, 21%, 42%	Three, weighted 31%, 31%, 38%
Delivery	PSI test center or remote proctoring	PSI test center or remote proctoring
Upkeep	10 CPE hours a year, 30 over three years, annual fee	10 CPE hours a year, 30 over three years, annual fee

The exam mechanics match, so nothing about format should decide this for you. Retakes also follow the same ladder in both guides: four attempts in a rolling 12 months, with waits of 30, 90, and 90 days.

What each exam covers

AAIR has three domains: AI Risk Governance and Framework Integration (37%), AI Life Cycle Risk Management (21%), and AI Risk Program Management (42%). The biggest domain is the daily work of a risk program: scenarios, treatment, controls, indicators, reporting, supplier risk, and incident and continuity planning. See domains explained.

AAISM has three domains: AI Governance and Program Management (31%), AI Risk Management (31%), and AI Technologies and Controls (38%). The largest domain looks at security architecture, the AI life cycle, data controls, privacy and trust controls, and monitoring. Its sub-areas are more technical than AAIR’s. See the AAISM overview.

Where they overlap

Both cover AI governance, policy, and the link to regulation and standards.
Both look at the AI life cycle and at data and asset management.
Both include vendor and supply chain concerns, and incident response and continuity.
Both use scenario-style, best-answer questions, so the same reading habits help.

Because of this, study for one gives you a head start on the other, but not a free pass. A risk question asks, “What is the exposure and how should we treat it?” A security management question asks, “What control or architecture protects this system?”

Where they differ

Viewpoint. AAIR looks at risk across the organization, including who owns it, how to measure it, and how to report it. AAISM looks at how to secure and run AI inside a security program.
Technical depth. AAISM has a whole domain on technologies and controls (38%). AAIR keeps most of its weight on governance and program work (79% across two domains).
Who qualifies. AAISM is tied to CISM or CISSP. AAIR accepts a wider set of designations, including audit and accounting ones.
Language options. Spanish is in both; Chinese is listed for AAIR and Japanese for AAISM.

How to choose

Look at your qualifying credential. If you hold CISM or CISSP only, AAISM is the straightforward path. If you hold CRISC, CISA, or an audit or accounting designation, check AAIR.
Look at your role. Risk owner, auditor, or advisor: AAIR. Security manager, architect, or CISO office: AAISM.
Look at what people ask you. “How risky is this AI project?” points to AAIR. “How do we protect this AI system?” points to AAISM.
Hold both qualifying credentials? Start with the one you will use first at work. Both can be earned, and CPE hours may count toward more than one ISACA credential if the activity fits each.

Not sure the credential is worth it at all? Read is AAIR worth it.

Taking both

Nothing in ISACA’s pages says you must take one before the other. If you plan both, a sensible order is the one that matches your role, then the second a year later. The overlap in governance, life cycle, and supplier topics means your notes carry over. Plan the upkeep too: each credential asks for its own AI-related CPE, so check renewal and retakes and ISACA’s AAISM maintenance page.

Frequently asked questions

Is AAISM harder than AAIR?

They share the same format and passing score. Which feels harder depends on your background: risk people often find AAISM’s technology domain harder, and security people often find AAIR’s risk language new.

Do I need CRISC for AAIR?

You need CRISC or another designation on ISACA’s list, such as CISA, CISM, CGEIT, CDPSE, or CISSP. CRISC is not the only route, but without a listed designation you cannot register for the exam.

Can I use the same notes for both?

Governance, life cycle, and supplier notes carry over. Risk method notes are mostly for AAIR, and security architecture notes mostly for AAISM.

More guides for AAIR

Next step

Read the AAIR overview and the AAISM overview, then try the question style with the AAIR practice exams or the AAISM practice exams.

Browse the practice exams