The AAIR is 90 multiple-choice questions in 150 minutes, and its weights are lopsided: Domain 3, AI Risk Program Management, is 42% of the exam, Domain 1 is 37%, and Domain 2 is only 21%. This study plan is built on ISACA's own content outline. It shows what each domain covers, what the exam costs, how the six-month window works, and how to turn the outline into a plan you can finish.
TL;DR
- 90 multiple-choice questions, 150 minutes, 450 out of 800 to pass on a 200 to 800 scale
- Exam fee US$459 for ISACA members and US$599 for non-members, plus a US$50 application fee after you pass
- You have 6 months from registration to take the exam; one 6-month extension costs US$75
- Domain weights: 37% AI Risk Governance and Framework Integration, 21% AI Life Cycle Risk Management, 42% AI Risk Program Management
- A qualifying prerequisite certification is needed to become certified, not to sit the exam
Quick Facts
| Item | Value |
|---|---|
| Exam fee | US$459 (ISACA member) / US$599 (non-member) |
| Application fee | US$50, paid after passing |
| Length | 150 minutes |
| Questions | 90 multiple-choice (scored items plus unscored pretest items) |
| Passing score | 450 on a scaled score of 200 to 800 |
| Languages | English, Spanish, Chinese |
| Eligibility window | 6 months from registration; one 6-month extension for US$75 |
| Retakes | Up to 4 attempts in a rolling 12 months: wait 30 days after attempt 1, then 90 days after each later attempt |
| After you pass | Five years to apply for certification with proof of an active prerequisite certification |
How Should I Plan My Study Time?
Your plan should start from the official AAIR content outline, not from a blog. It names every domain, every subtopic, and 23 task statements that describe what an AAIR holder is expected to do. Your plan is a way of working through that list until you can explain each item and apply it to a scenario.
Work in four phases:
- Gap check. Read the outline once and rate yourself on each subtopic: can you explain it, or have you not met it before? Be honest, because this rating decides where your time goes.
- Domain by domain. Study each domain in proportion to its weight. Domain 3 gets the largest share, Domain 1 the second largest, and Domain 2 the smallest, but give a subtopic extra time if it was a gap in phase 1.
- Timed practice. Move to practice sets at the real pace: 90 questions in 150 minutes is roughly 100 seconds per question. After each set, read the explanation for every option and re-rate yourself.
- Final review. Spend the last stretch on the subtopics that are still weak, not on the ones you already know well.
Register when you are ready to start, not as a placeholder, since your eligibility lasts six months from the day you register. If you need more time, a single six-month extension costs US$75.
How Should the Domain Split Drive My Study Time?
The weights are a study budget. Domain 3 is 42%, so it deserves more of your time than any other domain, and Domains 1 and 3 together are 79% of the exam. Domain 2 is the smallest at 21%, but it's also where the technical AI life cycle material sits, so do not skip it.
Domain 3: AI Risk Program Management (42%)42%
The largest domain has six subtopics:
- 3A AI risk scenario identification and assessment, for example threats, vulnerabilities, and attacks
- 3B AI risk treatment strategies
- 3C AI controls management, including evaluation, selection, and validation
- 3D AI risk metrics, monitoring, and reporting
- 3E AI supply chain risk management, for example third-party resources
- 3F AI incident response, business impact analysis, business continuity, and disaster recovery
Related task statements ask you to conduct risk assessments that identify and classify AI risk, develop and recommend treatment strategies, evaluate controls against the organization's risk tolerance, capture AI risk in enterprise risk metrics and reporting, evaluate AI risk as part of supply chain risk management, and work AI risk into incident response, business impact analyses, and continuity and disaster recovery plans.
Domain 1: AI Risk Governance and Framework Integration (37%)37%
The second-largest domain also has six subtopics:
- 1A AI models, frameworks, strategies, and use cases
- 1B AI organizational processes and alignment
- 1C AI ownership, oversight, and accountability
- 1D AI policies, procedures, and organizational training
- 1E AI regulatory compliance and legal considerations
- 1F AI trustworthiness, ethical, and societal implications, including ESG
Related tasks include integrating AI risk management into the enterprise risk management framework, developing an AI risk management framework with roles, accountability, policies, and acceptable risk tolerance, evaluating AI use cases against the organization's risk appetite, assessing compliance with AI-related regulations and standards, and addressing trustworthiness, ethics, bias, privacy, and safety.
Domain 2: AI Life Cycle Risk Management (21%)21%
The smallest domain has four subtopics:
- 2A AI design, development or procurement, and documentation
- 2B AI model training, testing, and validation
- 2C AI implementation, maintenance, and decommissioning
- 2D AI data and asset management
Related tasks include evaluating risk in AI models and solutions, covering design, suitability, algorithms, training, drift, and the life cycle, and integrating AI risk into change management.
If you come from a governance or audit background, look hardest at Domain 2 and the technical parts of Domain 3. The 21% weight is small, but those subtopics are likely where a governance background gives you the least head start.
How Do I Turn the 23 Task Statements into a Checklist?
The task statements in the official content outline are the most concrete description of what ISACA expects an AAIR holder to do, so they make a better checklist than a list of topics. Copy them into a spreadsheet and rate each one after every practice set. A few examples of what they ask for:
- Evaluate AI use cases based on the organization's risk appetite
- Integrate AI risk considerations into the existing risk register and control taxonomies
- Monitor and test organizational processes to identify AI risks
- Advise on AI-related risk within contracts and service agreements, including data usage and intellectual property
- Leverage AI to support the risk management program, for example risk profiles, reporting, and risk models
- Integrate AI-related risk considerations into the change management process
- Assess human oversight controls at critical decision points for risk and AI impact
Rate each task from "can explain it and apply it to a scenario" to "have not met this before." Anything in the second group moves to the top of your plan, weighted by its domain: a weak task in Domain 3 is worth more of your time than the same weakness in Domain 2, because Domain 3 is 42% of the exam. Re-rate after each timed set, and use the last stretch before the exam on whatever is still weak.
How Are AAIR Questions Written?
Every question has a stem and four answer options, and every question is designed with one best answer. The stem can be a question or an incomplete statement, and some questions turn on a qualifier such as MOST likely or BEST, so read the stem for that word before you look at the options.
Tips for answering: eliminate the options you know are wrong, then make the best choice from what is left. There is no penalty for a wrong answer, and your grade depends only on how many questions you answer correctly, so answer every question. The exam also contains unscored pretest items, which are not used to calculate your score.
Practise in the same shape. Read the stem, find the qualifier, remove the options that do not fit, and pick the best remaining answer. Then read why each of the other options is wrong.
Where Can I Practise with Realistic AAIR Questions?
ISACA sells a Questions, Answers & Explanations (QAE) database and offers a free practice quiz on its AAIR pages. Use the free quiz first to see the question style before you pay for anything.
CertCompanion's AAIR practice questions give you scenario-based practice with an explanation for every option. Start with the 30 free questions to see which domains need work.
| AAIR question bank | |
|---|---|
| Questions | 598 |
| Single-answer | 446 |
| Select-all-that-apply | 152 (25%) |
| Median explanation length | 87 words |
How Much Does the AAIR Cost?
The exam fee is US$459 for ISACA members and US$599 for non-members, nonrefundable and nontransferable. You pay it in full before you can schedule an appointment. After you pass, there is a separate US$50 application processing fee for certification.
If you need more time than the six-month window, one six-month extension costs US$75. The option appears on your dashboard 30 days before and after your eligibility ends. If you have a scheduled appointment, you must cancel it at least 48 hours ahead to extend.
If you do not pass, you can ask for a rescore in writing through ISACA's support page within 30 days of the results, at a cost of US$75 per request. Rescores are performed by PSI.
Who Can Sit the AAIR, and What Do I Need First?
You can register at any time, and you can schedule an appointment once the fee is paid. The prerequisite applies to certification: the AAIR is designed for risk professionals who already hold a qualifying certification, and to become certified you must submit an application with proof that a prerequisite certification is active.
The qualifying list includes CISA, CISM, CGEIT, CRISC, CDPSE, CISSP, CIA, CRMP, CRMP-FED, PMI-RMP, and several accounting and audit designations. If you hold the RIMS credential, see our RIMS-CRMP practice exam. If you are mapping out which ISACA credential to take next, the ISACA certification practice exams page lists them all.
To become certified you pass the exam, pay the US$50 application fee, submit the application with proof of your prerequisite, and adhere to ISACA's Code of Professional Ethics and its Continuing Professional Education policy. You have five years from passing the exam to apply.
How Does Scoring Work?
Scores are reported on a scale of 200 to 800, and 450 or higher passes. You see your preliminary pass or fail status on screen right after the exam, and the official score is emailed and posted online. Domain-level results are provided for information only: your score is based on the total number of items answered correctly, not on any single domain.
What Should I Know About Exam Day?
The AAIR is computer-based. You take it at an authorized PSI testing center or as a remotely proctored exam. A tutorial on the exam software appears after you log in at the testing station, so read it before the exam starts.
At a testing center, plan to arrive at least 30 minutes before the start time. One break of no more than ten minutes is allowed with your proctor's permission, and the exam timer does not stop during it, so a break costs you exam time.
Treat 150 minutes as a budget of about 100 seconds per question. Make a first pass, flag the questions where you are stuck, and return to them once everything else is answered. If you miss your appointment, or you do not take the exam inside the six-month window, you forfeit the exam eligibility and the registration fee. Rescheduling needs at least 48 hours notice.
How Do I Practise a Worked Question?
Coral Diagnostics operates a medical imaging AI system that has been in production for three years. Performance metrics indicate declining accuracy, and the regulatory environment has changed with new FDA AI/ML guidance. Following ISO/IEC 22989 AI lifecycle stages, which stage should the governance team initiate? (Select one!)
- A. Verification and Validation to retest the existing model against current requirements
- B. Retirement because declining performance indicates the system should be decommissioned
- C. Operation and Monitoring because continuous monitoring addresses performance decline
- D. Re-evaluation to assess whether the system continues to align with organizational objectives
Show the answer and the reasoning
Correct answer: D. Re-evaluation to assess whether the system continues to align with organizational objectives
Re-evaluation is the correct lifecycle stage where organizations assess whether the AI system continues to align with organizational objectives, regulatory requirements, and performance expectations. This stage addresses fundamental questions about continued operation given declining performance and regulatory changes. Verification and Validation is for testing during development, not reassessing strategic fit. Operation and Monitoring is ongoing but does not address the strategic question of whether the system still serves its purpose under new conditions. Retirement is premature without first conducting re-evaluation to determine if the system can be updated or must be decommissioned.
Frequently Asked Questions
Do I need a prerequisite certification to take the AAIR exam? Not to sit the exam. You need proof of an active qualifying certification when you apply to become certified after you pass.
How many retakes are allowed, and how long do I have to wait? Four attempts within a rolling 12-month period. After a failed first attempt you wait 30 days from that attempt, and after each later failed attempt you wait 90 days. The registration fee is paid in full for every attempt.
How long do I have to apply for certification after passing? Five years from the date you pass the exam. Someone who passes cannot retake the same exam within that application period.
In which languages is the exam offered? English, Spanish, and Chinese.
How many questions are on the AAIR exam? 90 multiple-choice questions in 150 minutes, made up of scored items and unscored pretest items.
Is there a penalty for a wrong answer? No. Your grade is based on the total number of questions answered correctly, so answer every question.
Ready to find your gaps before exam day? Start with free AAIR practice questions at CertCompanion.
Checked against official ISACA AAIR exam documentation and current candidate reports. Last verified 2026-10-30.