ISACA Advanced in AI Risk (AAIR) Practice Tests

This AAIR practice exam follows how ISACA weights the real Advanced in AI Risk exam. AI Risk Program Management is the heaviest domain at 42 percent, AI Risk Governance and Framework Integration carries 37 percent, and AI Life Cycle Risk Management the remaining 21 percent, so the 598-question bank gives each domain matching depth across vulnerability evaluation, impact assessment, and risk lifecycle judgment.

On test day you get 90 questions and 150 minutes through PSI, at an authorized test center or online proctored (remote proctoring is not offered in India, mainland China, or Hong Kong), and you need a scaled 450 on ISACA's 200-to-800 range, which is weighted by question difficulty rather than a straight percentage. AAIR is an advanced credential, not an entry point: you must already hold one of roughly 25 qualifying designations, including ISACA's CISA, CISM, CRISC, CGEIT, or CDPSE, or an accepted equivalent like CISSP or CIA. Registration costs $459 for ISACA members and $599 for non-members, opens a six-month window to sit the exam, and lets you schedule up to 90 days in advance. After passing, you have five years to apply for certification, which adds a $50 processing fee, then 10 CPE hours a year (30 per three-year cycle) and a $45 member or $85 non-member annual fee to keep it active.

ISACA launched AAIR on April 15, 2026, making it the newest of the three advanced AI credentials, after AAIA for audit and AAISM for security management. Because the question pool is that fresh, scenario judgment matters more than memorized definitions, and the hardest items ask you to weigh governance, life cycle, and program-management concerns against each other in realistic organizational settings. Start with the 30 free questions to benchmark yourself, then work through the full 598-question bank in short timed sessions until your accuracy holds steady across all three domains.

The ISACA Advanced in AI Risk (AAIR™) certification is an AI-focused IT risk management credential designed to validate advanced expertise in identifying, evaluating, and managing risks that arise from artificial intelligence adoption within organizations. It covers three core practice areas: AI Risk Governance and Framework Integration, AI Risk Program Management, and AI Life Cycle Risk Management. Together, these domains address the full spectrum of AI risk—from establishing governance structures and embedding AI risk into enterprise frameworks, to executing risk programs, evaluating AI-specific vulnerabilities, conducting impact assessments, and navigating risk throughout the AI development and deployment lifecycle.

The AAIR credential is part of ISACA's suite of Advanced AI certifications, alongside the Advanced in AI Audit (AAIA) and Advanced in AI Security Management (AAISM). Unlike these related credentials, AAIR specifically equips professionals to work cross-functionally, recommend risk responses, and guide senior management in safeguarding organizations from financial, reputational, and operational harms associated with AI integration. The certification is currently in beta, with a full launch anticipated for Q2 2026.

AAIR is intended for experienced IT risk and advisory professionals who already hold a recognized risk or security certification and are seeking to extend their expertise into AI-specific risk management. Eligible professionals must hold at least one active credential from the following: CISA, CISM, CRISC, CGEIT, CDPSE (ISACA credentials), or CRMP, CRMA, CGRC, CISSP, CERP, CRCM, or PMI-RMP (global designations). Because the program does not cover foundational IT risk concepts, it is best suited for mid-to-senior-level practitioners who already operate in risk management, compliance, governance, or advisory roles and need structured knowledge to address AI's unique risk profile.

Typical candidates include IT Risk Managers, Enterprise Risk Officers, AI Governance Leads, Chief Risk Officers, and Compliance Managers working in industries where AI adoption is accelerating—such as financial services, healthcare, technology, and government. It is also relevant for consultants who advise organizations on responsible AI adoption and integration strategies.

Candidates must hold at least one active qualifying credential at the time of application. Accepted ISACA credentials include CISA, CISM, CRISC, CGEIT, and CDPSE. Globally recognized designations that also qualify include CRMP, CRMA, CGRC, CISSP, CERP, CRCM, and PMI-RMP. These prerequisites are non-negotiable, as the AAIR program is explicitly designed to build on existing foundational IT risk knowledge rather than introduce it.

Beyond holding a qualifying credential, candidates should have practical professional experience working in IT risk management, AI governance, compliance, or a closely related advisory function. Familiarity with enterprise risk frameworks (such as COBIT, NIST, or ISO 31000), AI concepts including machine learning and generative AI models, and cross-functional risk communication will help candidates engage effectively with the curriculum and exam content.

The AAIR exam consists of scenario-based multiple-choice questions delivered in a proctored setting. The exam duration is 150 minutes. Scoring uses a scaled scoring model with a maximum score of 800 points, and the passing score is 450 out of 800—consistent with the scoring methodology used across ISACA's Advanced AI certification suite. The exact number of scored questions has not been published by ISACA as of the time of writing, as the certification is currently completing its beta phase ahead of a full Q2 2026 launch.

ISACA's Advanced AI exams are delivered online with remote proctoring available. Exam fees are estimated at approximately USD 575 for ISACA members and USD 760 for non-members, with an additional USD 50 application fee and annual maintenance fees of USD 45 (members) and USD 85 (non-members). Candidates are advised to check the official ISACA credentialing page for confirmed question counts, delivery options, and final pricing once the exam officially launches.

As organizations across industries accelerate AI adoption, demand for professionals who can rigorously manage AI-related risks is growing rapidly. AAIR holders are positioned for roles such as AI Risk Manager, Enterprise AI Governance Lead, Chief Risk Officer, AI Compliance Manager, and senior risk consultant specializing in responsible AI. These roles are emerging in regulated industries—including financial services, healthcare, and government—where AI governance requirements are being codified through regulations such as the EU AI Act and U.S. executive orders on AI.

Salary data for AI risk professionals in the United States ranges from approximately USD 90,000 to over USD 210,000 annually, depending on role, industry, and geography. ISACA-certified professionals have historically commanded a salary premium of 10–20% over non-certified peers, according to the Robert Half Salary Guide and Global Knowledge IT Skills and Salary Report. AAIR complements existing ISACA credentials—particularly CRISC—by adding a specialized AI risk layer that distinguishes holders in a market where general IT risk expertise is common but AI-specific risk governance skills remain scarce.

ISACA runs a zero-tolerance policy on exam fraud. If you sit the AAIR exam using memorized or leaked questions and ISACA's forensic review flags the pattern, your result gets nullified and the certification itself can be permanently revoked, not just the score. Because AAIR only launched in April 2026, ISACA is watching its first cohorts of test-takers closely for exactly this kind of abuse.

The honest path costs nothing to start: 598 AAIR practice questions on CertCompanion, 30 free, each with an explanation of the AI risk reasoning ISACA is actually testing, not just the letter answer. You walk out of the real exam able to explain your reasoning to an employer, which a memorized dump can never give you.