Choose your course
Welcome
Animated lesson
This week's lesson, narrated and drawn as it is explained.
AI tutor
Ask a question or get tested on this week's topic.
Quick links
Coming up
Quiz progress
Progress by phase
Exam blueprint tracker
Study streak
Badges
Your details
Study partner and record
Send your partner a summary each week so you keep each other on pace.
Back up and restore
Your progress, notes and drafts are stored only in this browser. Keep a backup so you can restore them or move to another device.
Inside the Claude viewer the download button may do nothing; use the code instead. Paste it into a note or email it to yourself.
Programme map
This week's plan
Reminders
Which certificates you need, and how this programme prepares you
Needed by both of you: AIGP. Needed if you build or consult: ISO/IEC 42001 Lead Implementer. The rest depend on the route you choose.
| Certificate | Who it is for | Prepared by | Entry rule | Cost (USD) |
|---|---|---|---|---|
| IAPP AIGP (needed) | Everyone working in AI governance | All 20 weeks. Domain I: weeks 1 to 3. Domain II: weeks 4 to 10. Domain III: weeks 11 to 14. Domain IV: weeks 14 to 17. Revision: week 19. | None | $649 member, $799 non-member. Retake $475 or $625. |
| ISO/IEC 42001 Lead Implementer (needed to build or consult) | People who set up AI management systems | Weeks 10, 11, 15, 16 and the capstone, then the provider's course and exam | Course with exam. With PECB, passing with no experience gives the Provisional Implementer title; the full Lead Implementer title needs five years of experience, two of them in AI. | $2,000 to $4,300 by provider |
| ISO/IEC 42001 Lead Auditor | People who audit or sell assurance | Weeks 10 and 16, then the provider's course and exam | Course with exam | Check provider |
| IAPP CIPP/E | Privacy route | Weeks 4 and 5 give the base | None | $550 |
| ISACA AAIA (audit), AAISM (security), AAIR (risk) | Experienced auditors, security and risk staff | Weeks 3, 9, 13, 14 and 16 give the base | An existing qualifying credential such as CISA, CISM or CISSP | AAIA about $459 for members; check ISACA for the others |
| CompTIA SecAI+ | Security route | Weeks 13 and 14 give the base | Check CompTIA | Check CompTIA |
Where the AIGP exam marks are
100 questions, scored from 100 to 500 with 300 to pass. Training providers report that 85 questions are scored, 15 are unscored trial questions, and about three in ten sit inside case studies. Domains III and IV together are more than half the exam, so weeks 11 to 17 deserve the most revision time. Confirm the current blueprint on the IAPP site before you book.
Audit against ten competitors
Checked in October 2026 against each provider's public course page. Matched means this programme now does the same job; Partly means it covers it at smaller scale.
| Competitor | What it does best | This programme |
|---|---|---|
| IAPP official AIGP training (from $1,195) | Official courseware covering the whole Body of Knowledge | Partly. Covers all four domains from free sources; it is not official courseware. |
| Privacy Bootcamp AIGP | 130+ modules, 400+ questions, 850+ flashcards, audio, exam simulator | Partly. Mock exam, flashcards and narrated lessons added; the bank is 160+ questions, not 400. |
| Training Camp AIGP boot camp | Live instructor, case studies, exam voucher | Partly. Case studies and scenario drills added; no instructor or voucher. |
| Udemy AIGP practice exams | Six full timed tests, 600 questions, weighted by domain | Partly. Timed, domain-weighted mock with a score by domain; one bank, not six tests. |
| Free question banks (CertCrush, Open Exam Prep) | 200 to 400 questions with explanations; 70% practice threshold | Matched on explanations and the 70% target; smaller bank. |
| Intellectual Point AIGP | 40 clock hours, skill application hours, certificate of training | Matched. About 100 hours, a portfolio document each practice week and a record of completion. |
| PECB ISO/IEC 42001 Lead Implementer | Four-day implementation method with an accredited exam | Partly. Teaches the method and gives templates; the exam must be taken with PECB. |
| BSI ISO/IEC 42001 Lead Implementer | Baseline review and plan, do, check, act with a tutor | Partly. Same method and a gap-review template; no tutor. |
| ISACA AAIA and AAIR | Depth in AI audit and AI risk for experienced staff | Partly. Weeks 3, 9 and 16 give the base; these need an existing ISACA or similar credential. |
| University and employer-led courses | A cohort, a tutor and a recognised name on the certificate | Partly. A study partner, an AI tutor and progress sharing; not an accredited award. |
What this programme still cannot give you: a live instructor, official IAPP courseware, an exam voucher, an accredited certificate or a bank of several hundred questions. The cheapest way to close the last gap is one paid practice-test set before you book the exam.
Other costs
- IAPP membership (optional): $295 a year, or $110 for government and not-for-profit staff.
- AIGP upkeep: $250 every two years, waived for members, plus 20 hours of continuing education.
- Study material for this programme: free.
Realistic budget to become employable: about $800 to $1,000 each for AIGP. Add the ISO certificate when an employer or client funds it.
Finishing this programme does not itself award a recognised certificate. Those come only from sitting the exam bodies' own exams.
Turning the programme into a job
- Search these titles. AI Governance Analyst or Officer, AI Risk Analyst, Responsible AI Lead, AI Assurance Consultant, Information Governance roles with an AI remit.
- Lead with evidence. Your capstone (governance pack, gap assessment, recorded workshop) goes on your CV and LinkedIn before the certificate does.
- Translate your past work. Rewrite existing projects in GRC language: data protection, risk controls, human oversight, testing, incident handling.
- Pick a sector. Health, public sector and financial services hire most. Sector knowledge plus AI governance beats AI governance alone.
- Look here. Civil Service Jobs, NHS Jobs, LinkedIn, AI assurance teams at consultancies, banks and insurers.
- Be visible. Post one short lesson a week from this programme. Attend IAPP chapter events.
- Expect a hybrid first role. Many postings want prior GRC, legal or audit experience. An engineering or information governance role with governance duties is a normal first step.
- Create your own experience. Offer a small business an AI inventory and acceptable-use policy. Paid or not, it is real client work.
What the work pays in the UK
| Role or level | Reported pay | Source |
|---|---|---|
| Data governance and AI ethics specialist | About £52,000 on average, £94,000 or more when senior | LSE careers article, 2026 |
| AI governance lead | £57,000 to £100,000 | QA job-role guide |
| Head of AI Governance, civil service | £71,381 to £80,419 (national band) | Ministry of Justice job advert |
| Mid-career AI governance manager | £78,000 to £132,000 base | VerifyWise salary report, May 2026 |
These are published figures from different sources and methods, so treat them as a rough guide. I found no reliable figure for entry-level analyst roles; check live adverts for those. Pay outside London and in the public sector is usually lower.
Exam drills
The AIGP exam is mostly short business cases. Before you answer, name three things: the role the organisation is playing, the framework being tested and the lifecycle stage. After you answer, say out loud why each wrong option is wrong.
Mock exam
Fifty questions in 82 minutes, half the length of the real exam at the same pace, drawn from a bank of over 160 questions, all with four or more options and some asking you to choose two and weighted like the official blueprint: 10 from Domain I, 12 from Domain II and 14 each from Domains III and IV. You get no feedback until the end, as in the real exam.
Aim for 70% or more. That is a practice target only; the real exam uses a scaled score, not a percentage.
Unlimited practice
Get five fresh scenario questions written by the AI for one domain. They are not checked by a person, so look up any answer that surprises you.
More practice with any AI app
Copy a ready-made prompt, paste it into any AI chat app and it will write five fresh scenario questions with answers. They are not checked by a person, so look up any answer that surprises you.
Questions to review
Flashcards
The key terms of AI governance. Tap the card to turn it over, then say whether you knew it. Cards you miss come round again.
Toolkit
Eight working templates. Copy one, fill it in for a real or realistic system, and keep it in your portfolio.
Case studies
Six real cases. For each, name the role, the lifecycle stage and the control that would have helped, then discuss the question on your call.
Summaries are from memory of public reporting. Read an original source before quoting any of them.
Consultancy track
Finish with seven documents an employer or client can read, three client projects to practise on, and the skills to sell the work.
Your seven deliverables
The pack opens as one document you can print or save as a PDF. To make a Word file, copy the pack and paste it into Word or Google Docs.
Three client projects
Each is a made-up client based on real kinds of work. Do one a month alongside the weekly programme, and use the deliverables above for the output.
Vendor risk review
Most organisations buy their AI rather than build it, so reviewing suppliers is a large part of the job. Use this method for any supplier, whether a model provider reached by API (such as OpenAI or Anthropic) or an assistant built into office software (such as Microsoft Copilot).
The six-step review
- Scope. What will we use it for, with which data, and who is affected? That sets how deep the review goes.
- Evidence. Collect the supplier's current terms, data processing agreement, security certificates and model documentation from its own trust or compliance pages. Terms change often, so date everything you rely on.
- Data. Is our data used for training? How long is it kept, where, and who can see it? Which sub-processors are involved?
- Controls. What can our administrators switch off, log and restrict? Is there single sign-on and role-based access?
- Roles and law. Who is provider and who is deployer? Is a data protection impact assessment needed? Does the use fall into a high-risk area?
- Decision. Approve, approve with conditions, or reject. Record the residual risk, the owner and the review date.
Contract terms to ask for
- No training on our data without written agreement.
- Notice before the underlying model changes, with time to re-test.
- Incident notice within a fixed number of hours.
- Audit rights, or access to independent audit reports.
- Return or deletion of our data at the end of the contract.
- Clear responsibility if the system's output causes loss.
Monitoring after you sign
- Every quarter: check usage, incidents, complaints and any change notices.
- On any model change: re-run your own test set before relying on it.
- Every year: refresh the full review and the certificates.
- Keep one page per supplier in the AI inventory with the owner and next review date.
Selling governance work
Discovery call: eight questions
- Which AI tools are in use today, including ones staff chose for themselves?
- Who is accountable for AI at board or director level?
- What prompted this conversation: a customer, a regulator, an incident or a tender?
- Which AI use worries you most, and why?
- Do you sell to, or serve people in, the EU?
- What policies and risk processes exist already?
- What would success look like in three months?
- Who decides, and what budget and timescale have you in mind?
Proposal structure
- Your situation, in the client's own words.
- What you will get: named deliverables, not activities.
- How we will work: steps, who is needed from your side, and dates.
- What is not included.
- Price and payment terms.
- Why me: one relevant example and one document from my portfolio.
Three ways to price
- Fixed-fee health check. Two weeks: inventory, gap assessment and a board summary. Easiest first sale because the scope is clear.
- Project. Build the governance programme: policy, risk process, assessments and training. Price by deliverable.
- Retainer. A set number of days a month to run reviews and keep documents current.
- Research current day rates for governance and privacy contractors before you quote. I have not given figures because I could not verify them.
Gap analysis report structure
- One-page summary: where you stand, the three biggest gaps, what to do first.
- Scope and method: what was reviewed and against which standard.
- Findings: for each, the requirement, the evidence, the gap and the risk.
- Roadmap: actions in 30, 90 and 180 days with owners.
- Appendix: evidence list and interview notes.
One-hour client workshop
- 10 minutes: what AI the business already uses. Build the list live.
- 15 minutes: three real cases of AI going wrong and what each cost.
- 15 minutes: sort the list by risk using a simple grid.
- 15 minutes: agree five rules for staff and name an owner.
- 5 minutes: next steps and the offer of a health check.
Interview practice
Twelve questions hiring managers ask for AI governance roles. Hear the question, answer out loud or in writing, then get feedback.
This course follows the published syllabus named in its course guide, checked in October 2026. It is not accredited by BCS or APM and was not written from their official textbooks, so read the required text and take the official sample paper before you book.
Content checked in October 2026. AI law moves quickly, so confirm dates and fees with the EU, the ICO and the IAPP before relying on them. This programme is study material, not legal advice.