Questions by certification

Six essentials domains: what AI, machine learning and generative AI are, and where they fail; risks and harms such as bias, hallucination, privacy, security, safety and misuse; principles and frameworks, with an overview of the OECD AI Principles, the NIST AI RMF, ISO/IEC 42001 and the EU AI Act risk tiers; data protection basics for AI, with GDPR and LGPD concepts; responsible use at work; and roles and accountability, including when to escalate.

There are 50 multiple-choice questions in 60 minutes, and you pass with 70% correct answers. The exam is online, with no scheduling and no prerequisite, and you can take it in English, Portuguese or Spanish. To practise first, the free RAIF open assessment has 20 questions with answer key and explanations. The result comes on the spot, with your per-domain performance, and those who pass receive the credential, the Open Badge and the PDF certificate at the same moment.

For any professional who uses AI at work or is affected by it, in any field: customer service, HR, marketing, operations, legal, finance, management and students too. It is the starting point for anyone who has never studied AI governance or privacy, and a simple way for a whole team to demonstrate the same essential knowledge.

No. The RAIF involves no code, no maths and no engineering detail. Questions ask you to recognise a risk, choose the responsible course of action in a work situation or know whom to escalate a problem to. Anyone who uses AI tools day to day and studies the syllabus has what they need.

It depends on your work. If you apply AI in product, data, engineering or risk, the RAIP is the natural next step. If your focus is privacy and data protection, the DPAI. If you are an executive or board member, the RAI-X. The RAIF is not a formal prerequisite for any of them, and it does not replace the RAIP or the DPAI as the prerequisite for the RAIL and the AUDAI.

It is if you apply AI at work and need to show you can do it under control: classifying a system, running a risk or impact assessment, documenting, testing and managing vendors. It costs USD 100, never expires and has no renewal fee. If you only need to demonstrate essential knowledge, the entry-level RAIF is probably enough. The public syllabus helps you decide before buying.

Seven practical domains: AI system lifecycle and inventory; risk assessment with the NIST AI RMF, AI impact assessments and DPIAs; the regulatory landscape, with EU AI Act obligations by role and risk tier and other relevant laws; data governance for AI; technical controls such as bias testing, evaluation, basic red teaming and human oversight; transparency and documentation; and third-party AI, with due diligence, contracts and shared responsibility.

There are 50 questions in 60 minutes, and you pass with 70%. The exam is online, with no scheduling, in English, Portuguese or Spanish, and questions describe work situations involving AI systems. There is no prerequisite. The price is USD 100, and the RAIP is also part of two discounted bundles: with the RAIL and with the DPAI.

It is not mandatory, but it is recommended. The RAIP assumes you already know the essentials the RAIF covers, such as the EU AI Act risk tiers and basic data protection concepts. The free RAIF open assessment is a quick way to test your foundations before investing in the RAIP.

They are different credentials, and the RAIP is neither equivalent to nor a replacement for the AIGP. The AIGP is IAPP AI governance credential, the best known in the field, with a renewal cycle and continuing education. The RAIP is an alternative focused on the practice of people who apply AI: it never expires, has no renewal fee and costs USD 100. AIGP is a trademark of IAPP, and DPCert is not affiliated with it; check current AIGP terms on IAPP official website.

Building and running an AI governance programme: charter, committee, policies and RACI; the ISO/IEC 42001 AI management system, with its clauses and Annex A controls; integration with enterprise risk management and board reporting; multi-jurisdiction regulatory strategy; AI incident and crisis management; culture, training and escalation channels; and case analysis across all of these topics.

Holding the RAIP or the DPAI credential. Whoever leads an AI governance programme needs a command of either AI risk practice or data protection, and the RAIL starts from there. The prerequisite is checked when you buy the exam on its own and when you open it. In the Responsible AI Track bundle (RAIP + RAIL), you sit the RAIP first and the RAIL opens once you pass.

There are 50 questions in 150 minutes, and you pass with 72%. Most start from a work situation, and the case analysis domain, with 5 questions, describes an organisation and asks for leadership decisions, such as prioritising risks, structuring a committee or responding to an incident. The exam is online, in English, Portuguese or Spanish, and costs USD 100.

No. The RAIL covers ISO/IEC 42001 in depth, with clauses, Annex A controls and certification readiness, but it is not a Lead Implementer certificate, it is not issued by ISO or an accredited body and it does not certify your organisation. It proves you can run an AI governance programme, and ISO/IEC 42001 is an important part of that.

For people who own, or will own, an organisation AI governance programme: responsible AI leads, risk and compliance managers, DPOs and privacy leads who have taken on AI, and technology and data managers. If you apply AI but do not run the programme, the RAIP is usually the right choice.

Both, plus a comparative view. The DPAI covers the foundations shared by data protection laws (personal data, controller and processor, principles and lawful bases) through the GDPR and the LGPD, compared with laws such as the CCPA/CPRA. It also covers data subject rights, accountability tools such as records of processing and DPIAs, security and breaches, international transfers, privacy in AI and analytics, and programme governance and audit.

There are 50 questions in 120 minutes, and you pass with 70%. There is no prerequisite, the exam is online, in English, Portuguese or Spanish, and costs USD 100. Questions describe real situations, such as handling a data subject request, assessing a breach or choosing a transfer mechanism. The DPAI is also part of two discounted bundles: with the RAIP and with the AUDAI.

No, because no certification does that: neither the GDPR nor the LGPD requires certification for the DPO role. The choice belongs to the organisation, based on expertise and independence. The DPAI is verifiable evidence that you have that expertise. In Spain there is an official DPO certification scheme linked to the AEPD; the DPAI is not that scheme.

For people whose main responsibility involves personal data: privacy analysts and managers, DPOs and their teams, legal and compliance professionals, and also information security, product and data people when they handle personal data. It is a good first paid step for people from a legal background who want to go on to the RAIL or the AUDAI.

The IAPP CIPP/E centres on European law, and the IAPP CIPM on running a privacy programme; both have a renewal cycle. The DPAI combines GDPR and LGPD foundations with a comparative view, programme practice and a domain on privacy in AI, never expires and costs USD 100. It is not equivalent to either. CIPP/E and CIPM are trademarks of IAPP, and DPCert is not affiliated with it; check current terms on IAPP official website.

No. The AUDAI covers auditing against ISO/IEC 42001 and ISO/IEC 27701, with control testing, nonconformities and reporting, but it is not a Lead Auditor certificate, it is not issued by ISO or an accredited body and it does not qualify anyone to issue ISO certificates to organisations. It proves you can audit AI and data processing with evidence and method.

Six audit domains: audit fundamentals applied to AI and data, such as independence, evidence and sampling; auditing against ISO/IEC 42001 and ISO/IEC 27701; auditing AI systems, with model documentation, data lineage, bias and performance evidence and monitoring logs; regulatory conformity, including EU AI Act conformity assessment and GDPR and LGPD compliance audits; third-party and supply chain assurance; and audit casework.

Holding the RAIP or the DPAI credential. To audit AI and data, you first need to know what is being audited. The prerequisite is checked when you buy the exam on its own and when you open it. In the Assurance Track bundle (DPAI + AUDAI), you sit the DPAI first and the AUDAI opens once you pass. No third-party audit credential is required.

There are 50 questions in 150 minutes, and you pass with 72%. Most describe an audit situation, and the audit casework domain, with 8 questions, presents evidence, such as policies, logs and test results, and asks for a judgement: is the control effective, is there a nonconformity, what evidence is missing. The exam is online, in English, Portuguese or Spanish, and costs USD 100.

For internal and external auditors, compliance consultants and second-line risk professionals who need to assess AI systems and data processing. It also suits people from IT or security audit who want to extend their scope to AI. If your job is to build the programme rather than audit it, the RAIL is usually the right choice.

For executives, board members, founders and directors who approve the use of AI and are accountable for its risks, without running the programme day to day. It assesses whether you can ask the right questions, read governance reporting and decide in risk and crisis scenarios.

There are 50 scenario-based questions in 60 minutes, and you pass with 70%. The short format is designed for an executive schedule. There is no prerequisite, and the exam is online, with no scheduling, in English, Portuguese or Spanish, and costs USD 100.

Five domains: board and executive duties on AI, such as oversight, fiduciary duty and disclosure; strategic risk (reputational, legal, operational and ethical) and risk appetite decisions; reading the signals, meaning what good governance reporting looks like and which questions to ask; regulation at executive level, with the EU AI Act, sector rules and liability trends; and crisis decisions, with AI incident scenarios.

No. The RAI-X does not test technical detail about models or engineering. Scenarios call for leadership judgement: whether to approve a use of AI, which risk to accept, what to require from the team and how to act in an incident. Familiarity with the RAIF concepts helps, but it is not a prerequisite.

The RAI-X is for people who oversee and decide; the RAIL is for people who build and run the governance programme. The RAI-X has 50 scenario questions in 60 minutes and no prerequisite. The RAIL has 50 questions in 150 minutes, covers ISO/IEC 42001 and risk management in depth, and requires the RAIP or the DPAI first. Many organisations will want both, held by different people.