AIGP vs CIPP: which certification to choose first

What each one covers

The CIPP is the IAPP's privacyprivacyThe principle that personal data used by or produced through an AI system stays within the purpose and the legal basis it was collected for. Three routes cause most of the trouble: personal data in training material that was never intended for it, model output that reproduces what the model retained, and purpose creep, where a system built for one use drifts into another the original basis never covered. The GDPR governs this in full, and the EU AI Act adds data governance duties for high-risk systems (Article 10). See DPIA, purpose limitation, responsible AI.Open full entry → certification, focused on data protection and privacy law. It comes in jurisdiction-specific variants: CIPP/E for European law including the GDPRGDPRRegulation (EU) 2016/679, the General Data Protection Regulation, the EU's law on the processing of personal data. It applies to AI wherever personal data enters training, inputs, outputs, or logs, and it operates alongside the EU AI Act rather than being replaced by it. See controller, processor, lawful basis, DPIA.Open full entry →, CIPP/US for United States privacy law, and further regional variants. It has been the established privacy credential for years and is the foundation of most privacy careers.

The AIGP is the IAPP's AI governanceAI governanceGovernance extended for AI: the same organizational steering at the highest level, widened to cover what makes AI different (it works in probabilities rather than fixed rules, learns from data, and can act at a speed and scale no human reviewer can match). It inherits the existing governance structure and brings AI inside the disciplines the organization already runs, rather than creating a parallel system in a silo. It operates on two levels, design and execution. See governance, governance design, execution level, responsible AI.Open full entry → certification. It covers the foundations of AI governancegovernanceThe system through which an organization steers itself: corporate governance, risk management, compliance, lines of accountability, risk appetite, and the operating model. It exists across everything the organization does, before and beyond AI. AI governance is this same system extended for AI. See AI governance, governance design, execution level.Open full entry →, how laws and frameworks apply to AI systemsAI systemA machine-based system that, for explicit or implicit objectives, infers from input how to generate outputs (predictions, content, recommendations or decisions) that can influence physical or virtual environments. The OECD-style definition followed by the EU AI Act.Open full entry →, and how to govern AI across development, deployment, and use. It is the newer credential, created as AI governance became a distinct discipline under the EU AI ActEU AI ActRegulation (EU) 2024/1689, the European Union's law on artificial intelligence. It takes a risk-based approach: prohibited practices, requirements for high-risk AI systems, transparency obligations for specific uses, and a separate regime for general-purpose AI models. Obligations are divided between providers and deployers. See general-purpose AI, conformity assessment.Open full entry → and comparable regimes, and the current exam runs on Body of Knowledge v2.1, effective 2 February 2026.

The key difference is the subject. The CIPP is about privacy and personal data; the AIGP is about the governance of AI systems, which is broader than privacy and includes fairnessfairnessThe responsible-AI principle that systems should not create or reinforce unjust discrimination; operationalized through bias testing, representative data and per-group thresholds. It has multiple, mutually incompatible mathematical definitions. Under the EU AI Act, providers of high-risk AI systems must examine their data sets for possible biases (Article 10), and several discriminatory uses are prohibited outright (Article 5). See bias, proxy discrimination, high-risk AI system, responsible AI.Open full entry →, safety, transparencytransparencyOpenness about the fact that AI is used and how it operates in general: disclosures, documentation, notices. Pairs with explainability, which addresses individual outcomes.Open full entry →, human oversighthuman oversightDesigned-in human ability to monitor, intervene in, override or shut down an AI system. It is meaningful only when the human has authority, information and time to act. One of the seven pillars of responsible AI, and under the EU AI Act a requirement for high-risk AI systems: Article 14 requires that those systems are designed so natural persons can effectively oversee them. Oversight that exists on paper but amounts to confirming in practice does not meet that bar. See override rate, automation bias, high-risk AI system, fairness, safety and reliability, privacy, security and robustness, transparency and explainability, accountability, responsible AI. In the IAPP AIGP body of knowledge, this principle appears as human-centricity, with human oversight as one of its elements.Open full entry →, and accountabilityaccountabilityThe principle that a named human or organization answers for an AI system's outcomes, through ownership, documentation, audit trails and redress; never the system itself. The EU AI Act attaches obligations to the role rather than the technology, with provider duties in Article 16 and deployer duties in Article 26, supported by technical documentation (Article 11) and record-keeping (Article 12). See provider, deployer, record-keeping, responsible AI.Open full entry → across the AI lifecycle.

At a glance

	AIGP	CIPP
Subject	Governance of AI systems	Privacy and data protection law
What it certifies	Building, deploying, and regulating AI responsibly across the lifecycle	Knowledge of privacy regimes, principlesprincipleOne of the seven responsible-AI values a governed system should live up to (fairness, safety and reliability, privacy, security and robustness, transparency and explainability, accountability, human oversight). A principle is abstract: it states an outcome, not a lever you can pull. It becomes governable by naming the harm that would breach it, assessing the risk that harm carries, and placing controls against that risk. Held this way, a principle becomes a pillar. See pillar, harm, risk.Open full entry →, and practice
Scope	Broad: fairness, safety, transparency, human oversight, accountability	Focused on personal data, per jurisdiction
Variants	One global exam (BoK v2.1, four domains)	Jurisdictional variants (CIPP/E, CIPP/US, and others)
Exam style	100 multiple-choice questions, about 30% linked to case scenarios; tests applied judgment	Multiple choice per variant; verify the current format at iapp.org
Best for	AI governance, AI riskriskIn the EU AI Act's terms, the combination of the likelihood that a harm occurs and the severity of it if it does. The link between a principle (via the harm that would breach it) and a control (the measure that reduces it). Naming the harm and assessing its risk is required by Art. 9 before any mitigation measure is chosen. See harm, control, residual risk.Open full entry →, or AI compliance roles	Data protection officers, privacy counsel
Maturity	Newer credential, rose with the EU AI Act	Established credential since the 2000s

Which one first

Neither certification requires the other, so the order is a career decision, not a formal one. Four common profiles:

You work in privacy today and want to stay there. CIPP first, in the variant of your jurisdiction. It is the recognized baseline for privacy roles, and the AIGP can follow when AI governance enters your remit.

You work in privacy and your organization is building an AI governance function. AIGP next. Your privacy background already covers the CIPP ground that matters most in practice, and the AIGP is what signals you can carry the new responsibility. This is currently the most common route.

You come from risk, audit, compliance, or legal without a privacy credential. AIGP first. Your goal is AI governance capability, and the AIGP tests exactly that. A CIPP variant is worth adding later only if personal data becomes a core part of your role.

You are a technologist taking on governance responsibility. AIGP. The CIPP would teach you privacy law you may never apply, while the AIGP covers the lifecycle, frameworks, and oversight duties your role now carries.

Cost and effort

Both are IAPP exams with the same cost structure: an exam fee that is lower for IAPP members, and a certification maintenance cycle that membership covers. Verify the current fees at iapp.org; they change and most third-party comparisons quote outdated numbers. The larger difference is study time. The AIGP is scenario-based and tests applied judgment, so plan for 50 to 100 hours of active preparation; the CIPP variants are jurisdiction-focused law exams where a legal or privacy background shortens the path considerably. For the full cost picture of the AIGP, see is the AIGP worth it.

If you are coming from privacy

If you already hold a CIPP and are moving toward AI governance, the AIGP is the natural next step, and your privacy background is an advantage. You will already understand impact assessmentsimpact assessmentA structured evaluation, carried out in the plan-and-design stage, of the harms an AI system could cause and the risk those harms carry, before the system is built. The first place the governance chain is run, and the cheapest point in the life cycle to reduce risk. The anchor artifact of the planning stage; under the EU AI Act, a fundamental-rights impact assessment is required for certain high-risk deployers. See harm, risk, life cycle.Open full entry →, accountability structures, and the regulatory mindset, which transfer directly. The new ground is the AI-specific material: the AI lifecycle, the frameworks (the EU AI Act, NIST AI RMFNIST AI RMFThe AI Risk Management Framework of the US National Institute of Standards and Technology, published as version 1.0 in 2023. It is a voluntary framework built around four functions: govern, map, measure, and manage. In a layered setup, it serves as the risk method inside a management system such as ISO/IEC 42001. See ISO/IEC 42001, ISO/IEC 23894.Open full entry →, ISO/IEC 42001ISO/IEC 42001The international requirements standard for AI management systems, published in 2023 and certifiable. It defines how an organization establishes, implements, maintains, and continually improves a management system for AI. Certification against ISO/IEC 42001 does not create a legal presumption of conformity with the EU AI Act. See AI management system, harmonized standard.Open full entry →), and the governance of AI-specific concerns such as biasbiasA systematic skew in data, model behavior, or outcomes that treats one group differently from another without justification. Bias usually enters through training data that reflects historical patterns. For high-risk AI systems, Article 10 of the EU AI Act requires examination of datasets for possible biases and measures to detect, prevent, and mitigate them. See fairness, proxy discrimination.Open full entry →, model risk, and autonomous systems. Be careful not to assume the AIGP is a privacy exam with AI added; it is its own subject, and the scenario-based questions test AI governance judgment specifically.

Holding both

For many people the honest answer is that the two are complementary. Privacy and AI governance overlap, because AI systems frequently process personal data and the EU AI Act connects to the GDPR at several points. Holding both credentials signals capability across the intersection where much of the regulatory pressure now sits, and the combination is increasingly what organizations building AI governance functions look for.

For the full picture of the AIGP, see the AIGP exam guide, and for a study plan, how to study for the AIGP.

If the AIGP is your path, try it before you decide: the AIGP preparation page has a real practice question and a full sample lesson, no account needed. The Academy track behind it builds the applied governance judgment the exam tests, for €199, one time.

Start with a real practice question →

Disclaimer

GovCompass is an independent resource and is not affiliated with, endorsed by, or sponsored by the IAPP. "AIGP", "CIPP", and "IAPP" are trademarks of the IAPP, used here for identification only. Verify current certification details at iapp.org.