AI Governance Guide
What an AI governance certification is for a person, the kinds that exist, what the EU AI Act does and does not ask of people, and the PECB AI courses we sell, with PECB's, CompTIA's and the EU's own sources linked.
← Back to Professional Development
For a person, an AI governance certification is a personal credential: proof, issued by a certification body after an exam, that you know how to govern, manage, secure or audit AI. You earn it by passing that body's exam, usually after a course, and meeting its other requirements: for PECB, an application, the PECB Code of Ethics and, for the higher levels, professional experience. You keep it by meeting that body's maintenance rules. An AI governance course or other AI governance training prepares you for that exam.
It is a different thing from certifying an organisation. An organisation can have its AI management system certified to ISO/IEC 42001, the international standard for AI management systems, by a certification body after a two-stage audit. That certificate belongs to the organisation, not to the people who built the system. Our ISO 42001 certification cost guide covers the organisation side: what decides the audit cost and how to check that a certification body is accredited.
We group the AI credentials open to individuals into six types. Names vary from one issuing body to another, so judge a credential by what its exam covers and who issues it.
Built on ISO/IEC 42001, the international standard for AI management systems. Lead Implementer credentials suit people who build and run an organisation's AI management system; Lead Auditor credentials suit people who audit one.
Cover AI strategy, governance, policy and risk across an organisation's AI work. They suit managers, product owners and governance officers who lead AI initiatives rather than build the systems.
Cover how AI systems are built and deployed, such as machine learning, deep learning and natural language processing, often with ethics and security alongside. They suit data scientists, engineers and technical leads.
Cover how AI systems are attacked and defended, from adversarial threats and prompt injection to security controls and monitoring. They suit security professionals and AI engineers.
Cover identifying, assessing and treating risks specific to AI, such as bias, security and transparency, against frameworks such as the NIST AI Risk Management Framework. They suit risk, compliance and assurance professionals.
Cover applying the EU AI Act: whether it applies to an AI system, which operator role an organisation holds and the obligations that follow. They suit legal, compliance and governance staff. The Act itself does not certify people.
The PECB courses we sell for each type are listed below.
The EU AI Act, Regulation (EU) 2024/1689, regulates AI systems and the providers, deployers and other operators that place them on the market or use them. It does not certify people. Its conformity assessment is, in the Act's words, "the process of demonstrating whether the requirements set out in Chapter III, Section 2 relating to a high-risk AI system have been fulfilled" (Article 3(20)), and the certificates it provides for are issued by notified bodies for AI systems (Article 44).
The Act's AI literacy rule, Article 4, is addressed to providers and deployers of AI systems, which the Act defines as natural or legal persons, public authorities, agencies or other bodies (Article 3(3) and (4)). It concerns the AI literacy of their staff and of others acting on their behalf, and it does not ask any individual to hold a credential. Regulation (EU) 2026/1744, the Digital Omnibus on AI, replaced Article 4 with effect from 27 July 2026, and its first paragraph now reads:
"Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."
Article 4(1), Regulation (EU) 2024/1689, as replaced by Regulation (EU) 2026/1744
Article 4 sits in Chapter I of the Act, which has applied since 2 February 2025 (Article 113). The Act defines AI literacy as "skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of this Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause" (Article 3(56)).
For high-risk AI systems, Article 26(2) adds that deployers "shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support". Since the 2026 amendment, that obligation applies from 2 December 2027 or 2 August 2028, depending on how the system is classified as high-risk.
In plain terms
Neither article requires a particular exam, course or certificate. A training credential about the Act, such as the PECB Certified EU AI Governance Professional, is issued by the body that runs it, in that case PECB. It shows what you know about the Act; it is not a certification issued by the EU.
This guide compares seven of the official PECB AI courses Mindset Cyber sells, from ISO/IEC 42001 Lead Implementer and Lead Auditor to AI security, AI risk and the EU AI Act, plus the CompTIA SecAI+ exam voucher. We also sell the two-day ISO/IEC 42001 Foundation, covered in our ISO 42001 training guide. Each PECB course price includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance and 12 months of access. Mindset Cyber is a PECB Authorised Titanium Partner, PECB's highest partner level.
AI management system
People who plan, implement, run and improve an organisation's AI management system to ISO/IEC 42001.
AI management system
Internal and external auditors, and anyone who will audit an AI management system against ISO/IEC 42001.
AI governance and leadership
AI project and product managers, business leaders and governance officers who lead AI initiatives.
Technical AI practitioner
AI practitioners, data scientists and IT managers who design, build and deploy AI systems.
AI security
Security professionals and AI engineers who secure AI systems. PECB expects a solid foundation in cybersecurity.
AI security
Experienced security practitioners. CompTIA recommends 3 to 4 years in IT and 2 or more years of hands-on cybersecurity.
AI risk
Risk, security, data and legal professionals who manage AI risk with the NIST AI RMF and the EU AI Act.
EU AI Act governance
Governance, legal, compliance and technical staff who put the EU AI Act into practice.
Australian prices attract 10% GST, shown before checkout.
PECB eLearning (ISO/IEC 42001 Lead Implementer and ISO/IEC 42001 Lead Auditor): Pre-recorded video lessons by PECB Certified Trainers, with quizzes and the official course materials on myPECB.
PECB Self-Study (CAIM, CAIP, AI Security Professional, Lead AI Risk Manager and EU AI Governance Professional): The official PECB course materials on myPECB, studied at your own pace, without video lessons.
The CPD credits are PECB's figures for each format and course length, from the PECB CPD Policy: 31 for a five-day PECB eLearning course and 16 for a five-day PECB Self-Study course. See PECB eLearning vs Self-Study for what each format includes. If you are new to ISO/IEC 42001, our ISO 42001 training guide also covers the ISO 42001 Foundation.
The SecAI+ price is for a single exam voucher: one attempt at the CY0-001 exam. Mindset Cyber does not run its own SecAI+ course; the SecAI+ page sets out what we sell for SecAI+, including the voucher with Retake Assurance. Training three or more people on PECB courses? See our team prices.
Scroll the table sideways to see every currency.
Australian prices are shown before GST and UK prices before VAT, with the tax-inclusive amount underneath. Prices are set in each currency and do not change with the exchange rate.
Several organisations issue AI credentials with similar names or acronyms, and they are not interchangeable. A PECB credential is issued by PECB, under PECB's own exam and certification requirements. Another body's credential with a similar name has its own exam, its own requirements and its own maintenance rules, and holding one is not holding the other.
Two examples from this page: PECB's course page abbreviates the PECB Certified Artificial Intelligence Security Professional as CAISP, an acronym another body uses for a different AI security credential; and the PECB Certified EU AI Governance Professional is a separate credential from other bodies' AI governance credentials with similar titles. If an employer, client or tender asks for a credential by name or acronym, check which body issues it before you enrol.
Match the course to the work you do, or will do:
Each course name jumps to its card above, with the format, exam and price.
Common questions about AI governance certification for individuals.
There is no single best one: the right credential depends on the work you do. To build or run an organisation's AI management system, look at ISO/IEC 42001 Lead Implementer credentials, and to audit one, ISO/IEC 42001 Lead Auditor credentials. To lead AI programs, look at AI governance and leadership credentials; to build AI systems, technical practitioner credentials; to secure them, AI security credentials; to manage AI risk, AI risk credentials; and for EU AI Act compliance work, EU AI Act governance credentials. If an employer, client or tender names a specific credential, that is the one to get, and check which body issues it before you enrol.
Not for people. The EU AI Act, Regulation (EU) 2024/1689, does not certify individuals: its conformity assessment checks whether a high-risk AI system meets the Act's requirements, and the certificates it provides for are issued by notified bodies for AI systems. What it asks about people's AI knowledge is addressed to providers and deployers of AI systems, not to their staff: Article 4, as replaced from 27 July 2026, requires providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and of others who operate or use AI systems on their behalf, and it does not require them to guarantee any specific level of AI literacy of any individual. A course credential about the Act, such as the PECB Certified EU AI Governance Professional, is issued by PECB, not by the EU.
For organisations. A certification body audits an organisation's AI management system against ISO/IEC 42001 and, if it conforms, certifies that management system; our ISO 42001 certification cost guide explains what decides that audit's cost. A person cannot be certified to the standard itself, but can hold a personal credential about it, such as PECB Certified ISO/IEC 42001 Lead Implementer or PECB Certified ISO/IEC 42001 Lead Auditor. Passing PECB's exam lets you apply; the Lead level also needs five years of work experience, two of them in AI management, and 300 hours of project or audit activities, and with less, PECB awards the level your experience supports, from Provisional upwards. PECB issues both under ISO/IEC 17024, the standard for bodies that certify people, and UKAS accredits PECB for them.
The PECB courses here are self-paced. PECB sets each of the seven as a five-day course, and our estimate, not a PECB figure, is about 30 to 40 hours of study for each. Each PECB exam lasts 3 hours, and the CompTIA SecAI+ exam 60 minutes. For Self-Study and eLearning, PECB asks you to complete the exam attempts and the certification application within 12 months of purchase.
PECB certifications are valid for three years. To renew one, you submit CPD credits and pay PECB's Annual Maintenance Fee during each three-year cycle: USD 390 per certificate for each cycle. Foundation, Provisional and Transition credentials need no maintenance. The first year of PECB certification maintenance is included in the price of each PECB course in this guide. Other certification bodies set their own renewal rules, so check them before you choose.
At Mindset Cyber, each PECB course in this guide is US$485 in the United States, A$699 + GST (A$768.90 including GST) in Australia and £367 + VAT (£440.40 including VAT) in the UK, and that price includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance and 12 months of access. The CompTIA SecAI+ exam voucher is US$279 in the United States, A$399 + GST (A$438.90 including GST) in Australia and £209 + VAT (£250.80 including VAT) in the UK for one exam attempt. Prices are set in each currency and do not change with the exchange rate.
Every source was checked on 26 October 2026.
Each course page shows the price in your currency, the exam details and what the course covers. If you have a question about the courses or the exam, get in touch.
