How to pass the AIGP exam
A plan weighted to the actual blueprint, the scoring mechanics that change how you should answer, and the specific confusions that cost people marks.
Start from the weighting
The blueprint is public, so there is no reason to distribute your study evenly. Question counts per domain:
Domain I
16–20
of 100
Domain II
19–23
of 100
Domain III
21–25
of 100
Domain IV
21–25
of 100
Domains III and IV are 42–50 questions between them. If your revision is mostly legal recall, you are studying for a minority of the paper.
A ten-week plan
Weeks 1–2
Domain I — foundationsDefinitions, AI-specific risks, the responsible-AI principles, roles and responsibilities, and life-cycle policy. Light on law, heavy on vocabulary you will rely on everywhere else. Get the principle names automatic now.
Weeks 3–5
Domain II — laws, standards, frameworksThe densest recall load on the exam: GDPR applied to AI, the EU AI Act’s risk tiers and operator duties, NIST AI RMF, OECD, ISO. This is the one domain where reading primary text pays.
Weeks 6–7
Domain III — governing developmentDesign and build, data governance in training and testing, release and monitoring. Shift your study mode here: stop memorising and start reasoning through scenarios.
Weeks 8–9
Domain IV — governing deployment and useDeployment decisions, vendor assessment, ongoing oversight. Largely application, and it overlaps with III — use the overlap rather than studying them as separate silos.
Week 10
Timed mocks and weak areasFull-length timed papers under real conditions. Review every miss until you can explain why the right answer is right AND why each distractor is wrong.
Compress or stretch it freely — the sequence matters more than the calendar. Do not move on from a competency until you can answer scenario questions on it, not just define its terms.
Scoring mechanics that should change your behaviour
- Scaled 100–500, pass at 300. Aiming for a consistent 75–80% on quality practice questions puts you comfortably clear.
- No penalty for wrong answers. Never leave a question blank.
- Multi-select is all-or-nothing. When an item says "select all that apply", treat each option as an independent true/false rather than hunting for the best answer.
- Three hours for 100 questions is around 1:45 each. Flag and move rather than stalling; the second pass is usually faster because later questions jog your memory.
How the questions are built
Most items are short scenarios ending in "what should the organisation do first", "what is the best approach", or "which obligation applies". Two habits help more than anything else:
- Identify the role before the answer. Provider or deployer? Controller or processor? Most distractors are correct duties belonging to the other role.
- Watch for sequence words. "First" usually rewards assessment before action — you cannot mitigate a risk you have not characterised. A DPIA before launch beats a control after it.
Traps that cost marks
| Memorising instead of reasoning | Roughly half the exam is Domains III and IV, which are application. Flashcards alone will plateau you around the pass mark. |
|---|---|
| Ignoring multi-select | Multi-select items are scored all-or-nothing. A near-miss scores zero, so they punish partial knowledge harder than their count suggests. |
| Confusing the assessments | DPIA (GDPR Art. 35), FRIA (AI Act Art. 27), conformity assessment (Art. 43) and a general AI impact assessment are four different things with four different triggers. |
| Confusing the roles | Controller/processor is GDPR. Provider/deployer is the AI Act. They are independent — you can be a processor and a provider simultaneously. |
| Answering from the news | The Body of Knowledge is v2.1. Regulation has moved since. If a question’s facts match the older position, answer from the BoK. |
Related
- Blueprint to source map — every competency mapped to the EU AI Act, NIST AI RMF and ISO 42001.
- What is the AIGP? — format, domains and who the certification is for.