Skip to main content
AI Act

AAIR: Advanced in AI Risk

The ISACA advanced credential for risk managers building an AI risk programme. AI risk assessment, risk treatment, AI risk governance. Three-day intensive, CRISC recommended as foundation.

ISACAExpert3 daysLiveSelf-pacedIn-house
  • Practitioner-led, taught by a working CISO
  • Exam & certificate included
Christophe Mazzola

Taught by

Christophe Mazzola

Practicing CISO · Founder of Cyber Academy

See full profile →

For

Right fit if you are.

  • ✓IT risk managers expanding portfolio to AI.
  • ✓CROs and deputy CROs adding AI to the enterprise risk taxonomy.
  • ✓GRC managers building the AI risk workstream.
  • ✓Compliance officers in regulated industries quantifying AI exposure for board sign-off.

Honest call

NOT for. When to skip it.

We'd rather you keep your money than buy the wrong path.

  • ✗Practitioners with no risk management background. CRISC or ISO 31000 Lead Risk Manager first.
  • ✗AI engineers wanting to learn risk. AAIR assumes risk-practitioner fluency.
  • ✗Junior risk analysts under two years of experience.

Outcomes

What you'll be able to do

  • 1Integrate AI risk into the enterprise risk-management framework alongside cyber, operational and strategic risk.
  • 2Assess AI risk across the model lifecycle (intake, design, deployment, monitoring, retirement) using AIMS-aligned methodology.
  • 3Quantify AI-specific risks (bias, hallucination, model drift, regulatory exposure under the AI Act) for board reporting.
  • 4Design AI risk treatment options balancing innovation velocity against regulatory and reputational exposure.
  • 5Build AI risk monitoring and reporting telemetry for ongoing oversight.

Programme

Day by day

Day 1AI Risk Governance and Framework Integration

  • Domain 1: AI Risk Governance and Framework Integration

    Coverage follows the current official ISACA exam-content outline.

By end of day

  • • Apply AI Risk Governance and Framework Integration concepts to practical and exam-style scenarios.
Day 2AI Life Cycle Risk Management

  • Domain 2: AI Life Cycle Risk Management

    Coverage follows the current official ISACA exam-content outline.

By end of day

  • • Apply AI Life Cycle Risk Management concepts to practical and exam-style scenarios.
Day 3AI Risk Program Management

  • Domain 3: AI Risk Program Management

    Coverage follows the current official ISACA exam-content outline.

By end of day

  • • Apply AI Risk Program Management concepts to practical and exam-style scenarios.

Public sessions

Upcoming public sessions

Open-enrolment cohorts. Pick a date and book your seat. Want a private cohort for your team instead? Request an in-house quote.

No confirmed live cohort right now. You can still:

Buy the self-paced licenceRequest an in-house quote

Deep dive

Everything inside this certification

The detail behind the headline. Read at your own pace. Each section answers a buyer question we get on discovery calls.

This preparation course covers the current AAIR: Advanced in AI Risk exam-content outline: AI Risk Governance and Framework Integration, AI Life Cycle Risk Management, AI Risk Program Management. It connects the official domains to practical governance, risk, audit, privacy, security, and operations scenarios as applicable.

ISACA requires candidates to hold a qualifying professional designation before registering for this advanced credential exam. Training, exam eligibility, passing the exam, and receiving the credential are separate steps.

Official credential and exam-content source: ISACA

FAQ

Buyers always ask

Is CRISC required to take AAIR?+

CRISC is strongly recommended. The AAIR curriculum assumes risk-management fluency (risk identification, assessment methodology, treatment options, monitoring). Without that foundation, the methodology discussions are uphill.

Equivalents accepted: ISO 31000 Lead Risk Manager, ISO/IEC 27005 Lead Risk Manager, or three years operating an enterprise risk programme. Cyber Academy assesses prerequisites case-by-case.

How does AAIR differ from ISO 23894 (AI risk management)?+

ISO/IEC 23894 is the international standard for AI risk management, published in 2023, aligned with ISO 31000. AAIR (ISACA) is a personal credential that draws on ISO 23894 alongside the AI Act, NIST AI RMF and ISACA risk standards. Many practitioners working in the AI risk space will reference ISO 23894 as the methodology; AAIR is the credential that attests they apply it competently.

What AI risks does AAIR specifically cover?+

Regulatory exposure under the AI Act (classification, conformity assessment, transparency obligations). Model risk (bias, fairness, hallucination, model drift). Data risk (training-data quality, lineage, consent under GDPR). Operational risk (model downtime, fallback handling, human-in-the-loop design). Reputational risk (visible AI failures, public sector deployments, vulnerable populations). Third-party AI risk (foundation-model dependency, vendor lock-in, supply-chain attacks).

How long is the AAIR exam?+

Three hours, scenario-based plus multiple-choice. Computer-based at a PSI testing centre. Same scoring scale as other ISACA credentials (200 to 800, 450 to pass).

Next step

Where this leads

Pillar guide

Read the full AI Act guide

EU AI Act readiness work for providers and deployers across the four risk tiers.

Ready to get certified?

Taught by a practicing CISO. Prices and exam terms shown up front.

Buy a live seatBuy self-paced licenceRequest a quote