The ISACA Artificial Intelligence Fundamentals Certificate tests whether you can put AI concepts in the right business, risk, ethics, and governance context. Knowing that a neural network exists is only the beginning. You need to know what it is for, where it can fail, and which broad concept best fits a scenario. This is a vocabulary-and-judgment exam, not a model-building exam.
The short version
- AI-Fundamentals has 60 multiple-choice questions, 120 minutes, and a 65% passing mark, or 39 correct answers.
- The exam is split evenly between AI Concepts and AI Implementations, each worth 50%.
- Learn distinctions, not just definitions: RPA versus machine learning, supervised versus unsupervised learning, and generative AI versus a large language model.
- Use the official Study Guide alongside AI-Fundamentals practice questions; one candidate report found video training too broad on its own.
- Remote check-in can take substantial time. Clear your workspace and close background apps before launch.
What ISACA is actually testing
This certificate sits between technology and decision-making. It is for people who need to discuss AI accurately without claiming to be machine-learning engineers: auditors, risk professionals, analysts, security staff, managers, and people moving into AI-adjacent work.
The exam maps AI concepts to organizational decisions instead of asking you to build a model. You need to identify the kind of AI involved, spot the governance concern, and choose the sensible next step. AI projects often fail before the model does: the data is unsuitable, the use case is vague, the controls are missing, or nobody owns the risk.
The questions reward context. Memorization helps, but it is not enough.
Exam at a glance
| Item | Value |
|---|---|
| Cost | US $120 ISACA member; US $144 nonmember |
| Duration | 120 minutes |
| Questions | 60 multiple-choice questions |
| Passing Score | 65% (39/60) |
| Format | Computer-based, remotely proctored multiple choice |
| Eligibility | Six months from registration to take the exam |
| Testing | Online remote proctoring |
| Retake Policy | Four attempts in a rolling 12 months; waits of 30, 90, then 90 days; full fee for each attempt |
ISACA confirms the question count, time limit, and pass mark. A candidate pass report describes four answer options per question, though that detail comes from limited community evidence rather than a published exam specification.
Two hours for 60 questions is roughly two minutes per question. That is workable. The problem is not raw speed. The problem is spending four minutes debating two answers that both sound true, then rushing through a later scenario containing the detail that decides the answer.
ISACA currently sells 2nd Edition preparation products, and its February 2026 candidate guide confirms the current format and domain split. No separately versioned public exam outline or official change log establishes a domain-by-domain difference from an earlier edition. The practical implication is simple: study against the current Study Guide and current domain structure, not old notes with uncertain alignment.
Who should take AI-Fundamentals
AI-Fundamentals fits an AI governance analyst, technology risk analyst, IT auditor, information security analyst, or data and analytics professional who needs a structured view of AI. It also fits non-technical professionals and career changers who need enough technical grounding to participate in AI discussions without drifting into vague language.
It is not deep technical validation. Someone already building models, tuning pipelines, or operating production AI systems may find the technical content introductory. For that person, the value is the shared vocabulary around business use, risk, ethics, and controls.
Wait if your immediate goal is to demonstrate hands-on engineering ability. This certificate gives you language for framing an AI system. It does not replace a portfolio, implementation experience, or a role-specific technical credential.
The two conceptual layers of the exam
The domain split is unusually clean. One half asks, “What is this AI thing?” The other asks, “What happens when an organization uses it?” Study them in that order. You need the nouns before you can reason about the decisions.
Domain 1, AI Concepts (50%)50%
This domain is the vocabulary layer, but “vocabulary” makes it sound easier than it is. The official scope includes AI terminology and characteristics; supervised, unsupervised, and reinforcement learning; neural networks; large language models and generative AI; computer vision; and robotic process automation. It also covers statistical modelling and regression.
Study this domain through comparisons. Supervised learning uses labeled outcomes. Unsupervised learning finds patterns or groups in unlabeled data. Reinforcement learning learns from feedback about actions and outcomes. Those distinctions look basic on a slide. Under exam pressure, they blur quickly.
A useful analogy is a filing system. Supervised learning is receiving folders already marked “approved” and “rejected,” then sorting new documents into those categories. Unsupervised learning is receiving an unlabelled pile and looking for natural groups. Reinforcement learning is different again: it is learning which actions lead to better outcomes over time.
Watch out for RPA. It often appears alongside AI, but it does not necessarily learn, infer, or adapt. A rules-based automation that copies data from one system to another can be useful without being machine learning. That boundary is exactly the sort of distinction this exam can test.
People who've written up their experience report that the assessment is high-level but that some questions were specific to ISACA’s Study Guide. Broad familiarity with terms may not carry you through definition-level distinctions. Use practice explanations to find the weak boundaries, then return to the Study Guide for precise review.
Make flashcards for pairs that sound similar. AI and machine learning are not interchangeable. Generative AI and a large language model are not interchangeable either. The useful study move is comparison, not repetition.
Domain 2, AI Implementations (50%)50%
The second domain moves from definitions to consequences. It covers AI algorithms and software, business and IT use cases, working with machine-learning models, AI security implementation, and the risk, ethics, and governance surrounding AI use.
Imagine a financial-services team proposing an AI-assisted process for reviewing customer documents. The model may be technically capable. That is only one part of the decision. The organization still needs to assess data suitability, fairness, privacy, security, exception handling, performance monitoring, accountability, and what happens when the system produces a wrong answer.
This domain lives in those questions. A technically correct answer can still be wrong if it addresses the model while the scenario asks about governance. A sound control can still be wrong if the question asks first for a business-use decision.
What shows up repeatedly in community threads is a scope problem. In an imbalanced-data scenario, a narrow technique may be relevant, but the best answer can be the broader concept that fully addresses the issue. Look first for an answer about data balancing before selecting a specific method such as undersampling.
That is not permission to choose vague answers. Match the scope of the answer to the scope of the problem. If the question asks for a governance response, a model-tuning answer may be incomplete. If it asks for the broadest remediation, a narrow implementation detail may not go far enough.
Governance material is easy to overlook, so it deserves deliberate attention. AI risk is not a topic bolted on after the technical content. Security controls, privacy considerations, ethical concerns, accountability, monitoring, and appropriate use determine whether an AI system should move from an idea to an organizational tool.
Where candidates can lose points
The observed risks are straightforward: relying only on video training, confusing related concepts, choosing an answer with the wrong scope, and using dumps.
First, do not rely only on video modules. One candidate report found ISACA’s online review course high-level and encountered Study Guide material that was not covered in the videos. Finish the course if it helps you establish a structure, but treat the Study Guide as the detailed domain checklist.
Second, learn the boundaries between related concepts. Candidates can recognize the words “machine learning,” “LLM,” “computer vision,” and “RPA” while still missing what makes each one distinct. This is where flashcards help, provided the cards force comparison rather than definition recall alone.
Third, read scenario questions for scope. A narrow action may solve part of the stated issue. The best answer solves the problem actually described. Read the final sentence carefully. It often signals whether ISACA wants a definition, a risk, a control, or the best overall action.
Finally, avoid exam-dump sites. They are not ethical preparation, and they train answer recognition rather than reasoning. They also cannot establish whether an answer reflects current official material. Skip them.
How to prepare without wandering
Start with CertCompanion’s AI-Fundamentals practice questions. Work through realistic questions and read every explanation, including explanations for correct answers. That is where fuzzy vocabulary becomes visible. CertCompanion includes detailed explanations for this exam; start with 30 free questions and aim for 80–90% across mixed practice before scheduling.
ISACA’s Artificial Intelligence Fundamentals Online Review Course, 2nd Edition provides a useful foundation. It covers AI functionality, applications, risks, and ethical considerations. Its weakness is depth: limited community feedback suggests that it should not be your only preparation source.
Use the official Artificial Intelligence Fundamentals Study Guide as a domain checklist. ISACA describes it as covering the domains, exam expectations, and example questions. Return to it after practice sessions and review the exact objective behind each missed question.
The provider’s broader ISACA exam hub is useful when you are comparing certificate pathways. Keep your actual study plan narrow. This exam has two domains. Study the two domains.
Official tools and materials can support that plan:
- The Artificial Intelligence Fundamentals Study Guide for objective-level review after practice.
- The AI Fundamentals Lab Package, 2nd Edition, for applying concepts.
- The AI Knowledge Quiz, an official 10-question preview drawn from ISACA AI courses.
- ISACA’s certificate resource hub for current preparation-product information.
Build flashcards for exact terms, then make scenario notes for implementation decisions. Write “What is the concern?” on one side and “data quality, privacy, fairness, security, accountability, or monitoring” on the other. When a scenario describes a model used in a business process, scan for the control gap.
A practical study sequence
Use a short sequence that alternates concept review with scenario practice.
- Take a mixed set of CertCompanion practice questions before you feel fully ready. Mark concepts you cannot explain in plain language.
- Study Domain 1 in comparisons: supervised versus unsupervised learning, RPA versus machine learning, LLM versus generative AI, and regression versus classification where relevant.
- Study Domain 2 through scenarios. For each use case, identify the business purpose, data concern, security concern, and governance owner.
- Review every missed practice question. Write down why the right answer is broader, narrower, or better aligned to the scenario.
- Use the relevant Study Guide sections for targeted review, then take another mixed set.
If two answers keep appearing plausible, stop taking new questions for a moment and write out the distinction. Treat the explanation as the next study task instead of focusing only on the score.
Study time by background
Only one reported study-time data point is available: an experienced data-analytics and financial-services professional with CISA and regular machine-learning exposure reported needing about 10 hours at most. That is useful context, not a general benchmark.
The ranges below are planning estimates, not reported candidate averages. Use them to schedule study time, then adjust based on your practice results.
| Background | Estimated hours | Notes |
|---|---|---|
| Experienced data, analytics, audit, or AI professional | 10–15 hours | One experienced candidate reported about 10 hours. Add time for terminology review and scenario practice if AI governance is new to you. |
| IT, security, or risk professional new to AI | 15–25 hours | A practical planning range for learning foundational AI concepts, then applying them to risk, ethics, security, and governance scenarios. |
| Beginner or career changer | 30–45 hours | A planning range for building AI vocabulary before working through implementation and governance decisions. The certificate is positioned as a useful topical overview for non-technical candidates. |
Readiness matters more than the number. Can you explain both domains without notes? Can you distinguish related terms quickly? Can you answer governance scenarios without defaulting to technical buzzwords? If not, you need more time.
On exam day
Treat remote proctoring as part of the exam, not an administrative footnote. One candidate reported a room inspection lasting more than 40 minutes. The same report described a secure-browser conflict with background applications that interrupted a session. These are limited community reports, but the preparation is easy and worth doing.
Use a bare desk or clean kitchen counter for the room sweep. Close video-conferencing tools, messaging clients, screen-sharing tools, and other background applications before launching the secure browser. Have your identification ready. Give yourself a generous check-in buffer.
During the exam, make one pass through questions you can answer confidently. Mark uncertain items. On the second pass, eliminate answers that solve a different problem than the one asked. A technically accurate statement is not automatically the best answer.
Read qualifiers twice. “Best,” “most appropriate,” and “first” change the task. For scenario questions, choose the answer whose breadth matches the scenario. Then move on.
What the certificate can do after you pass
AI-Fundamentals can signal that you understand the language of AI use, risk, and governance. It is most relevant when an employer needs people who can participate in AI projects without treating them as magic or as purely engineering work.
Roles aligned with this knowledge include AI governance analyst, technology risk analyst, IT auditor, information security analyst, and data or analytics professional. No credential-specific salary dataset is available, so there is no responsible salary figure to attach to this certificate.
A community report describes a large financial-services employer using the certificate in broader AI upskilling. That is anecdotal, not a market-wide demand signal. It does show where a foundational AI governance credential can fit: organizations that need multiple teams to share a working vocabulary before AI use spreads faster than policy.
ISACA lists several logical next directions for people who want a narrower specialization:
- ISACA AAIA for an audit-focused AI progression.
- ISACA AAISM for AI security management.
- ISACA AAIR for AI risk.
Choose based on the work you want to do. Audit, security management, and risk are different jobs.
The current candidate guide lists no continuing-education or annual-maintenance requirement for the certificate. Exam eligibility lasts six months after registration; that window concerns taking the exam, not maintaining the certificate after passing.
FAQ
Is the ISACA AI-Fundamentals exam difficult?
It is foundational, but foundational does not mean careless. The material covers familiar AI terms, yet questions can require precise distinctions and sensible judgment about implementation, risk, ethics, and governance. One experienced candidate described the assessment as straightforward and high-level. That is a single pass report, not a difficulty rating for every candidate.
How many hours should I study for AI-Fundamentals?
One experienced data-analytics and financial-services professional with CISA and regular machine-learning exposure reported using about 10 hours. A useful planning range is 15–25 hours for IT, security, or risk professionals new to AI, and 30–45 hours for beginners. Those latter ranges are planning estimates, not published candidate averages.
How many questions are on the AI-Fundamentals exam?
ISACA lists 60 multiple-choice questions with a 120-minute time limit. The passing score is 65%, which equals 39 correct answers out of 60. A candidate pass report describes four options per question, but the confirmed exam facts are the question count, duration, and passing mark.
Does the ISACA Artificial Intelligence Fundamentals Certificate expire?
Exam eligibility is valid for six months after registration. The current candidate guide lists no continuing-education or annual-maintenance requirement for this certificate. Do not treat the six-month exam window as certificate validity; they describe different parts of the credential process.
Are there prerequisites for AI-Fundamentals?
No formal prerequisite is documented in the available official material. The certificate is foundational, and limited community feedback suggests it can work as a topical overview for non-technical people and career changers. Familiarity with business technology, risk, data, or audit helps, but the domains begin with core AI concepts rather than advanced engineering tasks.
Is AI-Fundamentals worth it for an IT auditor or risk professional?
It is useful when AI systems are entering the processes you review, govern, secure, or assess. The implementation domain includes risk, ethics, governance, and AI security, which aligns closely with that work. It is less useful as proof of model-building ability. Treat it as a common-language credential for responsible AI use.
What is the AI-Fundamentals retake policy?
ISACA allows four attempts within a rolling 12-month period. After the first failed attempt, the waits are 30 days before attempt two, 90 days before attempt three, and another 90 days before attempt four; the full exam fee is due for every attempt.
Should I use CertCompanion or the ISACA online review course?
Use CertCompanion practice questions to test your reasoning and identify weak distinctions. Use ISACA’s Study Guide to review exact objectives, and use the online review course for structure. Limited community feedback says the video course can be high-level and may not cover every detail reflected in Study Guide questions.
The honest preparation standard
AI-Fundamentals is modest in length and cost, but it asks for disciplined thinking. Study Domain 1 until related terms stop blurring together. Then study Domain 2 until you can connect an AI use case to its data, security, ethics, ownership, monitoring, and risk decisions.
Success depends on both terminology recall and scenario judgment. Definitions help you eliminate distractors, while business context helps you identify the best remaining answer. CertCompanion practice questions should expose those gaps early, while ISACA’s Study Guide, course, and labs support targeted review.
Check your readiness with AI-Fundamentals practice questions at CertCompanion.
Checked against official ISACA AI-Fundamentals exam documentation and current candidate reports. Last verified 2026-10-02.