If you are preparing for the IAPP Artificial Intelligence Governance Professional (AIGP) exam, you do not need to spend a dollar to start. A surprising amount of the material the exam draws on is published for free by the same organizations that write the laws, standards, and frameworks you will be tested on. The trick is knowing what to read, in what order, and when to stop reading and start practicing.
This guide gives you an honest, no-cost study roadmap organized around the four AIGP exam domains. It points you to the official primary sources, explains how each one maps to the exam, and then tells you the part most study guides skip: the moment when free reading stops being the highest-leverage use of your time.
What the AIGP Exam Actually Covers
The AIGP is administered by the IAPP. The exam has 100 questions, runs for roughly 2.75 hours, and is scored on a scale of 100 to 500, with 300 as the passing score. IAPP publishes the material you will be tested on in two free documents you should download first:
- The AIGP Body of Knowledge (currently version 2.1, effective February 2026), which lists the exact domains and competencies the exam covers.
- The AIGP Exam Blueprint, which shows how questions are distributed across those domains.
You can find both, along with a free IAPP study guide, on the IAPP AIGP certification page. The Body of Knowledge v2.1 organizes the exam into four domains and thirteen competencies:
- Domain I: Foundations of AI governance - core AI concepts, terminology, and why governance matters.
- Domain II: How laws, standards, and frameworks apply to AI - the legal and normative landscape.
- Domain III: Governing AI development - building and validating systems responsibly.
- Domain IV: Governing AI deployment and use - operating, monitoring, and retiring systems in production.
Read the Body of Knowledge before anything else. It is your map. Everything below is organized to fill it in.
The Free Reading List, By Domain
Domain I: Foundations of AI Governance
Start with the material that establishes shared vocabulary and first principles. The OECD AI Principles are short, readable, and widely referenced across other frameworks, which makes them an efficient foundation. They introduce concepts like human-centered values, transparency, accountability, and robustness that reappear throughout the exam.
Pair this with the introductory sections of the NIST AI Risk Management Framework (AI RMF 1.0). The framing chapters define AI risk, trustworthiness characteristics, and why AI governance differs from traditional software governance. This gives you the conceptual backbone Domain I expects.
Domain II: How Laws, Standards, and Frameworks Apply to AI
This domain rewards breadth. You do not need to memorize every article, but you should understand the purpose, structure, and risk-based logic of the major instruments.
- The EU AI Act. Focus on its risk tiers (unacceptable, high, limited, and minimal risk), the obligations that attach to high-risk systems, and how it defines providers and deployers. This is the single most heavily weighted regulation on the exam.
- The GDPR, specifically as it relates to AI. Concentrate on automated decision-making, data minimization, lawful bases for processing, and data subject rights, since these intersect directly with how AI systems handle personal data.
- The ISO/IEC 42001 overview, the AI management system standard. Read the freely available scope and abstract to understand what a certifiable AI management system looks like and how it mirrors other ISO management standards.
Return to the NIST AI RMF here as well, because it functions as a voluntary framework that many organizations map their compliance programs against.
Domain III: Governing AI Development
Now shift from "what the rules are" to "how you build responsibly." The core functions of the NIST AI RMF, described as Govern, Map, Measure, and Manage, are the most useful free resource here. Study how each function applies during model design, data selection, training, and validation. Pay attention to how bias, explainability, and testing are handled before a system ever reaches production.
The high-risk system requirements in the EU AI Act also live partly in this domain, since they impose obligations on data quality, technical documentation, and record-keeping during development. Cross-reference the Act's development-stage duties with the NIST Map and Measure functions to see how a legal requirement becomes an engineering practice.
Domain IV: Governing AI Deployment and Use
The final domain covers what happens once a system is live: human oversight, post-market monitoring, incident response, and decommissioning. The NIST AI RMF Manage function is your primary free source. Combine it with the EU AI Act provisions on deployer obligations, transparency notices to affected people, and ongoing monitoring.
This is also where the OECD principle of accountability becomes concrete. Think about who is responsible when a deployed system drifts, produces biased outputs, or fails, and how governance structures assign and enforce that responsibility.
Why Free Reading Is Necessary but Not Sufficient
Here is the honest part. Reading primary sources builds genuine knowledge, and you should absolutely do it. But the AIGP does not test whether you have read the EU AI Act. It tests whether you can apply the right concept to a scenario, under time pressure, when three of the four answer options look plausible.
Those are different skills. Recognition, the feeling of "yes, I have seen this," is not the same as retrieval, the ability to produce the correct answer on demand. Timed, scenario-based practice questions are what convert passive familiarity into exam readiness. They surface the gaps your reading left behind, teach you the rhythm of roughly 100 questions in 2.75 hours, and train you to eliminate distractors.
A word of caution: do not use brain dumps or copied real exam questions. Sharing or using actual IAPP exam items violates IAPP policy and can cost you your certification. The right approach is to learn from primary sources and then drill with original practice questions that are written to the current Body of Knowledge and cite their sources so you can trace each answer back to the material.
That is exactly where AIGov Prep fits. Every question is original, mapped to the four domains, and cited so you can verify the reasoning against the same primary sources listed above. You can try 25 free AIGP practice questions to see how your reading holds up under exam conditions, and when you are ready for full-length timed sets, the AIGov Prep plans cover all four domains.
A Simple Study Sequence
- Download the IAPP Body of Knowledge and Exam Blueprint. Skim to build your map.
- Read the OECD AI Principles and the NIST AI RMF framing for Domain I.
- Work through the EU AI Act, GDPR (AI angle), and ISO/IEC 42001 overview for Domain II.
- Use the NIST AI RMF functions plus the Act's development duties for Domains III and IV.
- Test yourself with original, cited practice questions and review every miss against the source.
Do the reading first. It is free, it is legitimate, and it builds the foundation nothing else can replace. Then close the gap between knowing and passing with realistic practice. Start now with try 25 free AIGP practice questions and find out precisely where your studying stands before exam day.