AAIR Prerequisites and Eligibility Explained

The short version

ISACA requires a qualifying credential for AAIR, such as CISA, CISM, CGEIT, CRISC, CDPSE, or CISSP: its AAIR page says candidates must hold a qualified designation to register for the exam. To earn the credential after you pass, you must also submit proof of an active prerequisite credential. The guide does not list AI experience as a requirement, but familiarity with risk language clearly helps. This page follows ISACA’s AAIR candidate guide, checked on October 18, 2026. Rules can change, so confirm the current list with ISACA before you pay for the exam.

What ISACA lists

ISACA’s list of qualifying designations includes:

  • ISACA credentials: CISA, CISM, CGEIT, CRISC, CDPSE
  • Security and risk credentials: CISSP, CGRC, CRMP, CRMP-FED, CRMA, CRCM, PMI-RMP, CERP
  • Audit and accounting credentials: CIA, CGMA, and several chartered accountant and CPA designations (ACA, ACCA, FCA, FCCA, CA ANZ, Canadian CPA, U.S. CPA, Japanese CPA, and the Hong Kong CPA designations)

ISACA’s AAIR page repeats the idea and describes the audience as professionals with proven experience in IT risk or advisory roles.

What is required and what is not clear

Two things matter here. First, ISACA’s AAIR page says candidates must hold a qualified designation to register for the exam. Second, the steps to earn the credential include submitting an application with proof of a prerequisite credential in active status.

Without one of those designations you cannot register for the exam. The exam fee is nonrefundable, so check that your designation is on ISACA’s current list before you pay.

Other points that come with registering:

  • You must have an ISACA account, and your name there must match your government-issued ID.
  • You have six months from registration to take the exam.
  • After passing, you have five years to apply for the credential.
  • Holders must follow ISACA’s Code of Professional Ethics and Continuing Professional Education policy. ISACA’s maintenance page asks for 10 hours of CPE per year and 30 hours over three years; see renewal and retakes.

Recommended background

ISACA does not publish a “recommended years of experience” figure that we could find. From the outline, the following experience helps:

  • Writing or reviewing risk scenarios and risk registers.
  • Choosing and testing controls.
  • Reporting risk to management or a board.
  • Working with third-party vendors and contracts.
  • Taking part in incident response or continuity planning.
  • Some contact with an AI project, even in an oversight role.

Skills self-check

Rate yourself honestly. If you can do most of these, you are in good shape. If not, you know where to start.

  1. I can explain risk appetite, tolerance, and capacity, and how they differ.
  2. I know the difference between inherent, current, and residual risk.
  3. I can describe preventive, detective, and corrective controls with an example of each.
  4. I can name the three lines (management, risk and compliance, audit) and what each does for AI.
  5. I can explain what a key risk indicator and a key control indicator measure.
  6. I understand terms like model drift, training data bias, overfitting, and prompt injection at a basic level.
  7. I know that AI laws can sort systems by risk level and place duties on providers and deployers.
  8. I can describe what a business impact analysis and a continuity plan are for.
  9. I can say what to ask a vendor that supplies an AI model.
  10. I can read a short scenario and pick the BEST action when several are acceptable.

Fewer than five yeses? Give yourself the 8-week schedule in the study plan and start with the vocabulary.

Suggested preceding credentials

ISACA’s list is the answer here: any of the credentials above can serve. CRISC is the most obvious match for the content, because it covers IT risk, controls, and reporting. We mention it because the topics overlap, not because ISACA says it is the preferred path. Other lists of recommended paths online are not from ISACA, so we do not repeat them.

What you do not need

  • You do not need to code or build models.
  • You do not need a degree in data science.
  • You do not need to have sat an earlier AAIR exam, because it is a new credential.

Frequently asked questions

Can I take AAIR as my first ISACA exam?

No. ISACA requires you to hold a qualifying designation first, such as CRISC, CISA, or CISM.

Does AAIR replace CRISC?

No. ISACA lists CRISC as a qualifying credential for AAIR, so they sit side by side.

More guides for AAIR

Next step

Read the overview for the domains at a glance, and then decide which study plan fits. The AAIR practice exams work well as a first check on the self-list above.

Try these practice exams