PECB Certified EU AI Governance Professional: What It Covers, Who Needs It and How the Exam Works
The PECB Certified EU AI Governance Professional tests whether you can apply the EU AI Act in practice. This guide covers the six exam domains, the 80-question open-book exam, who needs the credential, and how it fits with ISO/IEC 42001.
The PECB Certified EU AI Governance Professional is an individual certification for people who have to apply the EU AI Act (Regulation (EU) 2024/1689) in practice. It tests whether you can decide if the Act covers an AI system, work out which role your organisation plays, classify the system by risk, and plan the governance, documentation and monitoring that follow. The exam has 80 multiple-choice questions, a 70% pass mark and is open book. It certifies you, not your organisation, and it does not make a company compliant with the Act.
Key Takeaways
What it is
A PECB credential on applying the EU AI Act, Regulation (EU) 2024/1689, inside an organisation. It is a personal certification, not an organisational one.
The exam
80 multiple-choice questions, 70% to pass, open book (the Act, course materials and your notes), taken online through PECB Exams with remote invigilation.
Six domains
Documentation, transparency and compliance formalisation carries the most weight at 23.75%, followed by management systems, risk, data and technical controls at 21.25%.
Two levels
Provisional needs only the exam. The full credential adds 5 years of professional experience, 2 in AI governance, and 300 hours of implementation activities, per PECB's candidate handbook.
Dates
The Act applies generally from 2 August 2026. The AI Omnibus moved stand-alone high-risk rules to 2 December 2027 and embedded high-risk rules to 2 August 2028.
ISO/IEC 42001
PECB positions the credential next to ISO/IEC 42001 Lead Implementer and Lead Auditor. ISO/IEC 42001 is not a harmonised standard under the Act, and certification does not confer legal compliance.
On This Page
What the certification is
PECB, the certification body behind the credential, builds it around the EU AI Act as a working law rather than a policy discussion. The course teaches the Act's purpose, scope, structure and risk-based approach. It then moves to the questions an organisation has to answer in order: does the Act apply to our AI systems, what role do we play for each one, which risk category does the system fall into, and what governance has to exist around it across its life cycle. The last part covers monitoring, reporting and continual improvement.
Roles are where the Act becomes personal. A single company can be a provider of one system, a deployer of another, and an importer or distributor of a third, and the obligations differ for each. The course works through providers, deployers, importers, distributors and authorised representatives, and it covers general-purpose AI models and systemic-risk scenarios as well.
PECB's course description also mentions the EU Data Act and its role in data access, sharing and use. The six exam domains, though, are built around the AI Act itself, so treat the Data Act as supporting context rather than a second syllabus.
The credential sits in PECB's AI portfolio alongside ISO/IEC 42001 Lead Implementer and Lead Auditor, Certified AI Manager and the Certified Artificial Intelligence Professional (CAIP). reconn is a PECB Authorized Global Training and Reselling Partner and sells this course as a self-study programme in English.
Important distinction:
Passing this exam makes you a certified professional. It does not certify that your employer's AI systems comply with the Act, and it is not a substitute for legal advice on a specific system. Conformity is assessed per system, against the Act, by the people and bodies the Act names.
Where the EU AI Act stands in October 2026
The timeline has moved since the Act was first published, so it is worth getting the current dates straight before you plan a study schedule or a compliance programme. The European Commission's AI Act page and the Council's simplification timeline give the picture below.
| Date | What applies |
|---|---|
| 1 August 2024 | The AI Act enters into force. |
| 2 February 2025 | Prohibited practices 1 to 8 apply, and so do the AI literacy obligations. |
| 2 August 2025 | Governance rules and obligations for general-purpose AI models apply. |
| 2 August 2026 | General application of the Act, including the Article 50 transparency duties. The AI Office and national authorities handle supervision and enforcement. |
| December 2026 | A ninth prohibition applies: AI systems that generate non-consensual intimate content or child sexual abuse material. Providers of systems already on the market before 2 August 2026 also have until 2 December 2026 to apply machine-readable marking to synthetic content. |
| 2 December 2027 | Stand-alone high-risk systems under Annex III (employment, credit scoring, education and similar uses) become subject to the high-risk rules. |
| 2 August 2028 | High-risk AI embedded in products covered by sectoral law (Annex I) becomes subject to the high-risk rules. |
The two high-risk dates come from the AI Omnibus, Regulation (EU) 2026/1744. The Council gave its final approval on 29 June 2026, the regulation was published in the Official Journal on 24 July 2026 and it entered into force on 27 July 2026. It also extended the simplified requirements available to SMEs to small mid-cap companies and added the new prohibition above.
Two points are easy to get wrong. First, the delay applies to high-risk systems, not to the whole Act. Prohibitions, general-purpose AI obligations and most transparency duties are already running, so a 2027 high-risk date is not a reason to postpone an inventory of your AI systems. Second, the penalties are real. Breaching the prohibitions can cost up to EUR 35 million or 7% of worldwide annual turnover, and transparency breaches sit in a lower tier of up to EUR 15 million or 3%.
How it fits with ISO/IEC 42001
ISO/IEC 42001 and the EU AI Act answer different questions. ISO/IEC 42001 is a management system standard: it tells an organisation how to set up, run and improve the policies, roles, risk processes and records for responsible AI, and it can be audited and certified. The EU AI Act is binding law: it tells specific operators what they must do for specific systems, depending on risk class and role.
That difference is why PECB pairs the credentials rather than merging them. Someone who knows the Act but has never built a management system will struggle to turn obligations into running controls. Someone who has implemented ISO/IEC 42001 but has not worked through role determination and risk classification can end up with a tidy system that misses what the law actually requires.
| Credential | The question it answers | Typical role |
|---|---|---|
| EU AI Governance Professional | What does the Act require of us, for which systems and in which role? | Compliance, legal, risk and governance leads |
| ISO/IEC 42001 Lead Implementer | How do we build and run an AI management system? | People who set up the policies, controls and records |
| ISO/IEC 42001 Lead Auditor | Does an AI management system meet the standard? | Internal auditors, consultants, certification-body auditors |
On accreditation: PECB became the first certification body to receive UKAS accreditation under ISO/IEC 17024:2012 for its ISO/IEC 42001 Lead Auditor and Lead Implementer personnel certification schemes. That speaks to how the 42001 personnel credentials are assessed. It says nothing about whether any organisation complies with the EU AI Act.
Key context:
ISO/IEC 42001 is not a harmonised standard under the EU AI Act, and an ISO/IEC 42001 certificate does not confer legal compliance. A management system gives you structure, evidence and discipline that help when you work through the Act's obligations. It does not replace that work.
Who should take it
PECB's audience for the credential is broad: governance and compliance leads, IT, security and technical staff, data professionals, consultants, legal and privacy professionals, managers and executives. These four groups get the most from it.
If you already handle GDPR, product compliance or regulatory change, this is the most direct credential for extending that work to AI. The role-determination and risk-classification material is the new ground. The documentation and transparency domains will feel familiar in shape, though the specifics are different.
Security teams are often handed AI governance by default because nobody else owns it. The Act's expectations on robustness, cybersecurity, data governance and human oversight overlap with controls you already run. The credential helps you separate what the Act requires from what is simply good security practice.
Engineers and product owners do not need to become lawyers, but they do need to know when a feature changes the risk class of a system or the role their company plays. PECB lists a basic understanding of AI or digital technology as the starting point, so you do not need a governance background.
If clients ask you about the Act, a recognised credential gives you a common vocabulary and a defined scope. For auditors and assessors it also pairs naturally with ISO/IEC 42001 Lead Auditor, since the standard gives you something auditable and the Act tells you what the system has to satisfy.
The six exam domains
PECB publishes domain titles and weights in the candidate handbook, not question content, and exam content cannot be shared. The descriptions below explain what the Act requires in each area, so you know what to be fluent in.
| Domain | Questions | Weight |
|---|---|---|
| 1. EU AI Act foundations and regulatory context | 10 | 12.50% |
| 2. Applicability, scope and role determination | 15 | 18.75% |
| 3. Organisational governance and compliance planning | 9 | 11.25% |
| 4. Management systems, risk, data and technical controls | 17 | 21.25% |
| 5. Documentation, transparency and compliance formalisation | 19 | 23.75% |
| 6. Compliance monitoring and life cycle management | 10 | 12.50% |
The Act's purpose, structure and risk-based logic, and where it sits among other EU rules on data protection, cybersecurity and product safety. Reading the recitals and the definitions early makes the rest easier to place.
Deciding whether something is an AI system under the Act, what its intended purpose is, whether any prohibited practice is involved, and whether you are a provider, deployer, importer, distributor or authorised representative. Because the answers drive every later obligation, this domain rewards careful reading of scenarios.
Governance structures, policies, roles, escalation paths, resourcing and quality management, plus an honest view of governance maturity. This is the planning layer that turns the Act into an internal programme.
Risk management across the life cycle, data governance, technical robustness, cybersecurity and human oversight. This domain is where ISO/IEC 42001 knowledge helps most, because the same practices appear in a management system.
The heaviest domain. In practice it covers technical documentation, instructions for use, record-keeping, transparency notices and the formal steps that show a system meets the requirements. It rewards knowing the Act's structure well enough to find the right provision quickly.
Post-market monitoring, handling changes to a system, incident handling and continual improvement. The Act treats compliance as something maintained after deployment, not a one-time gate.
Exam and certification requirements
The exam has 80 multiple-choice questions, each with three options, one correct. Some are standalone and some are scenario-based, with five related questions per scenario. The pass mark is 70%. It is open book: you may use a copy of the EU AI Act, the training course materials and your own course notes, on screen or printed. It is delivered online through the PECB Exams application with remote invigilation, and online results are instant. The handbook does not state the exam duration, so confirm it when you book.
The PECB Certified Provisional EU AI Governance Professional requires passing the exam and signing the PECB Code of Ethics, with no professional experience. The full PECB Certified EU AI Governance Professional requires the exam, 5 years of professional experience including 2 years in AI governance, and 300 hours of implementation activities, plus two professional references who are not people you supervise or relatives. The hours count only if they follow good practice across areas such as governance structures, AI system identification and risk classification, risk mitigation, data governance, documentation and human oversight, and monitoring.
PECB sets no cap on retakes, though time limits apply between attempts, and reconn enrolments include the first attempt and one free retake. You must apply for certification within 12 months of purchase for self-study. Certification lasts three years. To renew you need to meet the CPD requirements and pay the annual maintenance fee, and missing both during the cycle leads to a 12-month suspension and then revocation.
Open book does not mean easy. With 80 questions and scenarios to read, you will not have time to look up everything. Mark where the Act defines key terms, lists the provider and deployer obligations, and sets out the transparency duties, so you can go straight there. Build your own one-page map of the six domains with the matching Articles. Practise reading a scenario and naming the system, the role and the risk class before you look at the options. There are no practice questions to hand out, because PECB treats exam content as confidential, and nobody can honestly promise a pass.
How reconn delivers the course
reconn offers the course as self-study in English. The programme includes more than 400 pages of PECB courseware, access for 12 months from enrolment, and 31 CPD credits. The training fee includes the first exam attempt, one free retake, the certification application fee and the first year of the annual maintenance fee. PECB sets and proctors the exam on the PECB Exams app, and reconn does not administer it.
Every enrolment also includes a free 60-minute 1-on-1 mentoring session and direct email and WhatsApp support until you clear the exam, within the same 12-month window. I run these sessions myself as a PECB Certified Trainer, and they are usually spent on the part self-study cannot do for you: working a real system of yours through role determination and risk classification and checking your reasoning.
The course starts from USD 799, and prices vary by region, so check the product page for yours. Bundles pair it with ISO/IEC 42001 Lead Implementer, Lead Auditor or both through eLearning. If you want the full syllabus and day structure before you commit, download the brochure.
Course brochure
Syllabus, learning objectives, exam details and what is included, in one PDF.
Download the brochure (PDF)Choosing your starting point
If your job is to answer the question 'does the Act apply to this, and what do we have to do about it', start with this credential. If your job is to build the system that produces the evidence, start with ISO/IEC 42001 Lead Implementer and add this one second. Auditors will usually want both. None of the three makes an organisation compliant, but each makes you more useful to the people who are accountable for it.
Whatever you choose, do the unglamorous first step now: list the AI systems your organisation builds, buys or deploys, and write down your role for each. Every domain in this exam starts from that list.
Further Reading
- EU AI Act: The Complete Global Guide: The risk tiers, prohibited practices, high-risk and general-purpose AI obligations, timeline and penalties.
- ISO 42001 vs EU AI Act: Overlaps, Gaps & Roadmap: Where the voluntary standard and the binding law overlap and differ, with a five-phase roadmap for running both.
- AI Governance Framework Comparison: ISO 42001 vs NIST AI RMF vs EU AI Act vs OECD: How the four main AI governance instruments differ and how to layer them in one programme.
Frequently asked questions
It is a PECB personnel certification for professionals who apply the EU AI Act, Regulation (EU) 2024/1689, inside an organisation. It covers applicability and role determination, risk classification, governance, documentation, transparency and monitoring across the AI life cycle. It certifies the individual, not the organisation.
The exam has 80 multiple-choice questions with a 70% pass mark. It is open book: you can use a copy of the EU AI Act, the training course materials and your personal course notes. It is taken online through the PECB Exams application with remote invigilation.
No. The Provisional credential requires passing the exam and signing the PECB Code of Ethics, with no professional or AI governance experience. PECB lists a basic understanding of AI or digital technology as the starting point.
According to PECB's candidate handbook, the full credential requires passing the exam, 5 years of professional experience including 2 years in AI governance, 300 hours of implementation activities and two professional references. Confirm the current figures in the handbook before you apply.
No. It certifies you as an individual. Compliance is assessed per AI system against the Act and depends on your role, the risk class of the system and the evidence you hold. The credential helps you do that work but does not replace it or legal advice.
No. ISO/IEC 42001 is not a harmonised standard under the EU AI Act, and an ISO/IEC 42001 certificate does not confer legal compliance. It is a management system standard that gives structure and evidence you can use when meeting the Act's obligations.
Stand-alone high-risk systems under Annex III apply from 2 December 2027, and high-risk AI embedded in regulated products under Annex I applies from 2 August 2028. The Omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026. Prohibitions, general-purpose AI obligations and most transparency duties are not delayed.
Start with EU AI Governance Professional if your role is compliance, legal, risk or governance and you need to interpret the Act. Start with ISO/IEC 42001 Lead Implementer if your role is to build the management system and controls. Many people take both, and reconn offers bundles that pair them.
No. The AIGP is a separate credential issued by a different body. The PECB credential is built around Regulation (EU) 2024/1689 and its six exam domains. Check each body's published scope and exam outline before choosing.
The self-study course in English with more than 400 pages of PECB courseware, 12 months of access, the first exam attempt, one free retake, the certification application fee and the first year of the annual maintenance fee. You also get a free 60-minute 1-on-1 mentoring session and email and WhatsApp support until you clear the exam, within your 12-month window.
Sources
- European Commission: AI Act
- Council of the EU: timeline of simplification omnibus packages
- Regulation (EU) 2026/1744 in the Official Journal (Law and Technology)
- Jones Walker: what still applies on 2 August 2026
- PECB: EU AI Governance Professional candidate handbook
- PECB Conference: Inside the EU AI Governance Professional credential
About the Author
Shenoy Sandeep
Shenoy Sandeep is the Founder of reconn, an AI-first cybersecurity firm based in Dubai, UAE. With 20+ years across cybersecurity focussing on offensive security and threat intelligence portfolio, and over 10 years in Enterprise AI, AI governance and data protection, he has assisted over 25+ startups in scaling their business in the Middle East and African region.
Training is Shenoy's passion project and reconn has associated themselves with PECB, the global leaders in personal certifications for AI, cybersecurity, data protection, privacy and business continuity professionals. He is a PECB-certified trainer and one of the world's early PECB-certified AI professionals, also specialising in ISO/IEC 27001, ISO/IEC 27701, ISO 42001, ISO 22301, and GDPR.
Via Reconn, Shenoy runs an advisory service assisting organisations in the EMEA with compliance and certification on ISO 42001, ISO 27001, ISO 27701, ISO 22301 and local data protection and privacy laws. His current interests include EU AI Act, NIS2, DORA, EU/UK GDPR, UAE PDPL and SDAIA PRPL.
