CRAI
ISACA Certified in Risk of Artificial Intelligence (emerging)
AI risk management and governance — emerging blueprint, expect revisions.
› Quality score
Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.
› Built for these roles
› Exam format
Multiple-choice exam, ~85 questions over 2 hours, online proctored. Newly launched (2024) — expect content updates.
ISACA member $575 / non-member $760. 4 attempts per rolling 12-month window.
› Recertification
Continuous CPE earning under ISACA's standard model: ~14 CPEs/yr plus the $45/yr ISACA member fee ($85/yr non-members).
› 3-year cost of ownership
Excludes study materials, training, retake risk, and lost-wage opportunity. Use as a floor estimate.
› NICE Framework work roles
The NIST NICE work-role IDs this cert maps to. NICCS lookup.
› Core domains covered
The 3 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.
EU AI Act compliance, NIST AI RMF, AI risk assessment, model cards, algorithmic auditing, AI incident response.
Risk frameworks (NIST RMF, ISO 31000, FAIR), policy development, audit, regulatory compliance, third-party risk.
Training data poisoning, PII leakage from models, differential privacy, federated learning security.
› Also touched
Present in the blueprint but not the primary focus — you’ll be introduced but shouldn’t expect depth.
Guardrails, content filtering bypass, model monitoring, drift detection, output control.
Data classification, encryption-at-rest/in-transit, DLP, tokenization, privacy-by-design, plus the regulatory stack (GDPR, CCPA, HIPAA) that sets the bar.
› Prerequisites
Risk, audit, or GRC background recommended. Emerging credential — expect blueprint changes over the next 18 months.
- AI lifecycle risk frameworks
- NIST AI RMF / EU AI Act familiarity
- Model governance concepts
› Progression
requiredrecommendedWhere this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.
No vendor-gated prereqs.
No certs require this one.
No follow-on certs reference this one yet.
› Study materials
Curated starting points. Not exhaustive — vet each against your learning style and the current exam version.
- ISACA Risk of AI Resources — ISACA
- ISACA Official Risk of AI Online Course
- ISACA QAE (when released)
› Version & lifecycle
Newer ISACA AI-risk credential — separate from AAIR (which has CRISC prerequisite).
› Salary signal
AI risk professional, US, 3-5 years.
ISACA Salary Survey extrapolation · 2024 · US base only · p25–p75 range
› How it compares
AIGP is broader AI governance program; ISACA Risk of AI is risk-discipline focused.
↔ Compare side-by-side› Careers that commonly pursue this cert
The policy/controls counterpart to the AI Security Engineer — owns risk frameworks, regulatory mapping (EU AI Act, NIST AI RMF), model documentation, and AI incident response policy.
See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.