AIGP vs ISO/IEC 42001
These are searched as alternatives and are not alternatives. The AIGP certifies a person; ISO/IEC 42001 certifies an organisation's management system. They answer different questions, are bought by different people, and most organisations doing serious AI governance end up with both.
| AIGP | ISO/IEC 42001 | |
|---|---|---|
| What is certified | A person. You hold the credential. | An organisation. The management system is certified. |
| Issued by | The IAPP, a professional association. | An accredited certification body, against an ISO/IEC standard. |
| What it demonstrates | That you understand AI governance: the concepts, the laws, and how to govern AI across its life cycle. | That your organisation runs a documented, audited AI management system that actually operates. |
| How it is assessed | A 100-question exam, three hours, scored 100–500 with a 300 pass mark. | External audit of your management system, in stages, with surveillance audits afterwards. |
| Typical buyer | An individual, or an employer paying for a named person. | An organisation, usually driven by customer or regulator assurance demands. |
| Effort | Weeks of study for one person. | Months of organisational work: policies, roles, records, internal audit, then external audit. |
| Renewal | Continuing professional education credits plus annual maintenance. | Surveillance audits and periodic recertification of the management system. |
| Fails when | You cannot choose between two defensible answers under time pressure. | The system exists on paper but the organisation does not actually follow it. |
How they relate
ISO/IEC 42001 is inside the AIGP syllabus
The Body of Knowledge names 42001 explicitly as one of the three core ISO AI standards, alongside 22989 for terminology and 42005 for impact assessment. Studying for the AIGP teaches you what 42001 is; it does not implement it.
They answer different questions
The AIGP answers "does this person know how to govern AI?". ISO/IEC 42001 answers "does this organisation govern AI?". A customer doing due diligence on your company wants the second; a hiring manager wants the first.
Neither is a legal requirement
The EU AI Act does not require either one. Both are ways of demonstrating capability against obligations the law imposes directly — which is why "we are certified" is never by itself a compliance answer.
The order usually runs one way
People who lead a 42001 implementation are frequently AIGP-certified first, because the credential supplies the vocabulary and the regulatory map the implementation depends on. The reverse order is rarer.
Which one your situation calls for
You want to work in AI governance
AIGP. It certifies you, and it is portable between employers. ISO/IEC 42001 lead-auditor or lead-implementer training is a reasonable second step once you are doing the work.
Your customers are asking how you govern AI
ISO/IEC 42001. An individual credential does not answer a due-diligence questionnaire about your organisation. Certifying the management system does.
You have to prepare for the EU AI Act
Start with the AIGP syllabus, because it maps the obligations and the roles. A 42001 management system is a good vehicle for operating them, but knowing which obligations apply comes first.
You are one person doing governance at a small company
AIGP first, and probably only. A full 42001 certification is a substantial organisational undertaking and is rarely proportionate until customers or regulators are asking for it.
A note on the other standards
ISO/IEC 42001 rarely appears alone in exam questions. It sits with ISO/IEC 22989 (terminology and concepts — the vocabulary the others build on) and ISO/IEC 42005 (AI system impact assessment — the method behind the assessments the EU AI Act and the GDPR demand). Distinguishing the three is a recurring item, and 42001 is the one you can be certified against. See BOK terms mapped to their source frameworks for how these fit with NIST, the OECD and the EU AI Act.
LearnAIGP is an independent study aid and is not affiliated with the IAPP or with ISO. For certification scope and requirements, the IAPP's pages and the published ISO/IEC standards are authoritative.