How the certification exams are built

Every certification starts from a syllabus split into domains, each with a weight in the exam. The syllabus is mapped topic by topic before a single question is written, so the exam measures what the certification page promises: EU AI Act, GDPR, LGPD, NIST AI RMF, ISO/IEC 42001 and the professional practice around them, in the proportions the blueprint states.

Questions are written to three cognitive levels: recalling a concept, applying it to a situation, and analysing a case with competing constraints. Practitioner, leader and auditor exams lean towards application and analysis, and the leader and auditor exams each have a case analysis domain.

Each question has a stem that asks a complete question, four options and one best answer. There are no "all of the above" options, no trick wording and no trivia such as memorised article numbers: the question asks what a competent professional would do or conclude.

Wrong options are plausible, based on real misconceptions, and every question carries a rationale explaining why the right answer is right and why each distractor is not. Scenarios vary sectors and regions, and wording is checked for bias and for readers whose first language is not English.

A new question enters the bank as a draft and is never drawn. Before it is activated, two subject-matter reviewers answer it independently, without seeing the answer key. Any disagreement between them, or with the key, sends the question back for rewriting, and the decision is recorded.

AI tools may help draft or translate a question, but no question is activated without human review. Every change to a question in use keeps the previous version, with date and author, so when a candidate challenges a question the answer starts from the exact text they saw.

Each exam is drawn at the moment the candidate opens it. The draw follows the number of questions per domain in the blueprint, so two exams of the same certification measure the same things in the same proportions, with different questions.

The seed of the draw is stored with the attempt. If an exam needs to be audited, it can be rebuilt question by question.

For each question the exam draws from a domain, the bank must hold at least 2 active questions in that domain. Each candidate therefore sees only part of the bank, and anyone memorising questions from earlier candidates meets only some of them, mixed with others.

The exam never borrows questions from another domain to make up numbers. A larger bank lowers the overlap between candidates further, and the rule adjusts on its own as the bank grows.

DPCert exams can be taken in English, Portuguese or Spanish, like the website, handbooks and support. English is the source language, written in plain international English; the Portuguese and Spanish versions are adapted for native speakers, with the technical terminology of each language, rather than translated word for word.

Each translation is stored as the same question, never as a new one, and one language may not be easier than another: if the success rate of the same question differs by more than 15 percentage points between languages, the translation goes to human review.

The open assessment is free, has the same format as the certification exam and shows the right answer with its rationale. That is why it uses its own bank: no practice question ever appears in a certification exam, and the separation is physical, in different tables.

The per-domain results it records show where candidates struggle with the format before they sit an exam.

After 30 uses, each question has two classical measures: its p-value, the share of candidates who answer it correctly, and its point-biserial correlation, how well it separates candidates who did well on the whole exam from those who did not.

A question that is too easy, too hard or weakly discriminating is flagged. One that almost everyone gets right and that no longer separates those who know from those who do not carries the signature of a leaked question. Flags are reviewed by a person, never acted on by the formula alone.

A retired question leaves the draw with the reason recorded. Retiring a question never changes a result already delivered.

Questions are also reviewed when the law or standard they test changes, for example when the dates or wording of the EU AI Act are amended. A question that is no longer correct is retired, not left in the bank.

Passing depends only on the candidate’s score against the published passing score. There is no curve, no quota of passes, and other people’s performance has no effect.

An unanswered question counts as wrong. Every question has four options and exactly one correct answer, so there is no partial credit.

Exams are taken online without a live proctor, under rules the candidate accepts before starting: a fixed time limit, one attempt per voucher, and tracking of every exit from the exam window. Exits above a published limit hold the credential for review, and repeated exits end the attempt.

Unusual patterns, such as an exam finished far faster than its length allows, are recorded for review. A credential obtained in breach of the rules can be revoked, and revocation shows on the public verification page.

Changing the passing score, the number of questions, the duration or the weights requires a new blueprint version, approved and recorded publicly in the candidate handbook.

The change applies to exams opened after publication. Each attempt keeps the blueprint version it was taken under, and no past result is recalculated.

Our certification process is designed with reference to the principles of ISO/IEC 17024, the international standard for bodies that certify persons: impartiality, separation between training and certification, a documented scheme for each credential and confidentiality of the exam. DPCert sells no mandatory course, and training partners never see exam questions.

DPCert is not accredited under ISO/IEC 17024. We keep a written gap analysis against the standard and work through it in order; this page is updated as each step is completed.