62%

of organisations still lack a formal, comprehensive AI policy, while 90% say staff already use AI. ISACA AI Pulse Poll 2026.

ISACA Advanced in AI Risk (AAIR) certification

AI Is Live.
Governance Is Not.

AI is already in daily use, but most organisations are running it without a full rulebook, and one in four has no AI policy at all. AAIR proves you can govern, assess and manage AI risk before it turns into an incident.

HRD Corp claimableYayasan Peneraju: may be eligibleKL or online

Exam

ISACA AAIR

Course

2 days

Course fee

RM7,000

Exam fee

Included

Next intake

25 Feb 2027

Quick answer

What is AAIR?

ISACA Advanced in AI Risk (AAIR) is ISACA’s AI risk certification, launched in April 2026. It validates that experienced IT risk professionals can evaluate AI-related vulnerabilities and manage AI risk through governance, the AI life cycle and a risk programme. It is open to holders of CRISC or another qualifying credential, and the exam is 90 questions.

Exam facts verified against isaca.org on 25 Oct 2026

FOR

CRISC, CISA, CISM and other qualifying credential holders in risk roles

ROLES

IT risk manager, enterprise risk lead, GRC specialist, AI governance lead

SKIP IF

You hold no qualifying credential yet. Start with CRISC

01

The Credential

What you study, practise and sit to earn it.

Hold an active CRISC or another qualifying credential, pass the AAIR exam and apply to ISACA within five years. AAIR completes ISACA’s advanced AI trio alongside AAIA for audit and AAISM for security.

COURSE

2 days, 3 domains

FOCUS

Managing enterprise AI risk

EXAM

90 questions, 2.5 hrs

CREDENTIAL

ISACA AAIR

Awarded by

ISACA

Level

Advanced, AI risk

Prerequisite

CRISC or another qualifying credential

Apply within

5 years of passing the exam

Upkeep

10 AI CPE hours a year

Related

AAIA, AAISM, CRISC

02

Decide in 60 Seconds

Four options people weigh against each other.

If you want to

Choose

Why

Manage AI risk across the enterprise

→

AAIR

AI governance, life cycle and risk programme

Audit AI systems and controls

→

AAIA

AI audit for CISA, CIA and CPA holders

Lead AI security

→

AAISM

AI security management for CISM and CISSP holders

Get the IT risk credential first

→

CRISC

ISACA’s IT risk management credential

A qualifying credential is required. Are you ready?
0/4

Tick what applies. 3 or 4: you are ready for this course. Fewer: start with CRISC.

03

What the Exam Covers

Three domains from ISACA’s AAIR exam content outline. Bars to scale.

3 domains, 90 questionsLargest: AI Risk Program Management, 42%

AI Risk Program Management 42%
AI Risk Governance and Framework Integration 37%
AI Life Cycle Risk Management 21%

Source: ISACA AAIR exam content outline.

04

What the Course Covers

Two days across the three AAIR domains.

Two days of instructor-led training for experienced risk professionals. You build on your CRISC or other credential and focus on what changes when the risk sits in an AI system.

Domain 1

AI Risk Governance and Framework Integration

  • AI models, frameworks, strategies and use cases
  • Ownership, oversight and accountability
  • AI policies, procedures and training
  • Regulatory compliance and legal considerations
  • Trustworthiness, ethics and societal impact

Domain 2

AI Life Cycle Risk Management

  • Design and data
  • Training and testing
  • Deployment and monitoring
  • Decommissioning

Domain 3

AI Risk Program Management

  • AI risk scenarios and assessment
  • Controls, metrics and reporting
  • AI supply chain risk
  • Incident response and continuity

90

questions on exam day. Each domain includes exam-style practice so you learn how ISACA asks.

05

Why Now

How far AI governance lags AI use, and why train with us.

1 in 4

organisations have no active AI policy at all

ISACA AI Pulse Poll 2026

56%

do not know how quickly they could halt an AI system after a security incident

ISACA AI Pulse Poll 2026

20%

do not know who would be responsible if an AI system caused harm or serious error

ISACA AI Pulse Poll 2026

6 hrs

Six Hours to Report. Who’s Watching the Alerts?

Malaysia’s Cyber Security Act 2024 (Act 854) came into force on 26 August 2024. Critical infrastructure entities must report a cyber security incident within six hours, and managed SOC monitoring services now need a licence. Boards and regulators will ask who owns AI risk, and risk professionals will be expected to answer.

NACSA; Cyber Security (Notification of Cyber Security Incident) Regulations 2024

ISACA Accredited Elite Partner

Training aligned to ISACA’s AAIR job practice

Exam included

One fee covers training and your exam

HRD Corp registered

This course is HRD Corp claimable

KL or online

Instructor-led in class or live online

06

The Cost, All In

Every figure per person, in ringgit.

Fees

Two-day courseIncluded

AAIR exam registrationIncluded

Funding

HRD Corp claim for employersClaimable

Yayasan Peneraju financing (Bumiputera)May be eligible

Course with exam

RM7,000

Dates

Where

Fee

Thu 25 to Fri 26 Feb 2027

Kuala Lumpur or online

RM7,000 incl. exam

Mon 12 to Tue 13 Apr 2027

Kuala Lumpur or online

RM7,000 incl. exam

Mon 4 to Tue 5 Oct 2027

Kuala Lumpur or online

RM7,000 incl. exam

Wed 15 to Thu 16 Dec 2027

Kuala Lumpur or online

RM7,000 incl. exam

Training a team? We run private intakes on dates that suit your organisation, with HRD Corp claims handled alongside you.

07

Exam and Renewal

What exam day looks like, and what happens after you pass.

Certification

ISACA Advanced in AI Risk (AAIR)

Questions

90 multiple choice

Duration

2.5 hours

Passing score

450 on a 200 to 800 scale

Delivery

PSI test centre or remote proctoring

Eligibility window

Six months from registration

Eligibility

Active CRISC or another qualifying credential

Exam fee

Included in the course fee

EVERY YEAR

10 hours of AI CPE

From the calendar year after you certify, earn and report 10 CPE hours in the specialised domain of artificial intelligence each year.

ALSO REQUIRED

Keep your base credential

Keep your qualifying credential active, follow ISACA’s Code of Professional Ethics, and pay the annual maintenance fee.

FAQ

Questions People Ask

What is AAIR?

ISACA Advanced in AI Risk (AAIR) is ISACA’s AI risk certification for experienced IT risk professionals. It covers AI risk governance and framework integration, AI life cycle risk management, and AI risk programme management.

Holders of an active CRISC or another qualifying credential, including CISA, CISM, CGEIT, CDPSE, CISSP, CGRC, CIA, CRMA and several accounting designations. ISACA also expects proven experience in IT risk or advisory roles.

At Trainocate Malaysia the two-day AAIR course is RM7,000 per person, including the exam. The course is HRD Corp claimable, and Malaysian Bumiputera learners may be eligible for Yayasan Peneraju funding.

90 multiple-choice questions in 2.5 hours, scored on ISACA’s 200 to 800 scale. You can sit it at a PSI test centre or with remote proctoring.

Three domains: AI Risk Program Management (42%), AI Risk Governance and Framework Integration (37%), and AI Life Cycle Risk Management (21%).

CRISC covers IT risk management. AAIR builds on it for AI, with a focus on governance, the AI life cycle and running an AI risk programme.

Earn 10 CPE hours in artificial intelligence each year, keep your qualifying credential active, and pay the annual maintenance fee.

Own the Risk in Enterprise AI

Pick an intake. An advisor confirms fees, your eligibility, HRD Corp claims and Yayasan Peneraju with you.

  • Next intake: 25 to 26 Feb 2027
  • RM7,000, exam included

Sources

  1. ISACA: AAIR certification
  2. ISACA: AAIR exam content outline
  3. ISACA: Get AAIR certified
  4. ISACA: AAIR launch press release (15 Apr 2026)
  5. ISACA Madrid Chapter: AAIR exam details
  6. ISACA: 2026 AI Pulse Poll press release (5 May 2026)
  7. ISACA: AI Pulse Poll 2026 preview press release (23 Mar 2026)
  8. Trainocate: AAIR course page
  9. NACSA: Cyber Security Act 2024 (Act 854)
  10. MAICSA: Act 854 regulations summary