- What the AAISM CPE Requirement Actually Demands
- What Counts as an "AI-Specialized" CPE Hour
- CPE Topics Mapped to Each AAISM Domain
- What Does Not Qualify for AI Hours
- Where to Earn Qualifying AI CPE Hours
- Annual Minimums vs. Three-Year Cycle Strategy
- Scheduling CPE Around AAISM Domain Weights
- Frequently Asked Questions
- AAISM requires at least 10 CPE hours per year specifically in AI-specialized topics, with 30 hours total across a 3-year cycle.
- Generic cybersecurity or IT governance CPE does not automatically qualify - content must demonstrably address AI security management.
- Domain 3 (AI Technologies and Controls) carries 38% of exam weight; CPE in AI architecture and security controls directly reinforces your highest-stakes...
- ISACA governs AAISM CPE eligibility; you must also maintain an active CISM or CISSP throughout the AAISM certification lifecycle.
What the AAISM CPE Requirement Actually Demands
Earning the Advanced in AI Security Management (AAISM) certification is only the beginning. Because AI risk and technology move faster than nearly any other domain in information security, ISACA built an unusually specific ongoing education requirement directly into the credential's structure. It is not enough to accumulate generic professional development hours and report them. The AAISM maintenance framework demands that a meaningful portion of your continued learning stays tightly focused on artificial intelligence.
The numbers are straightforward: you must earn a minimum of 10 CPE hours per year in AI-specialized topics, and at least 30 CPE hours total across the full three-year certification cycle. ISACA governs both the standard and what qualifies. Because AAISM launched on August 19, 2025, and is still in its inaugural version as of early 2026, ISACA's published guidance should be treated as the authoritative source - and candidates should monitor any clarifying bulletins as the credential matures.
There is also an often-overlooked prerequisite dimension: you must maintain an active CISM or CISSP throughout the entire AAISM lifecycle. That means your CPE planning must simultaneously satisfy ISACA's CISM renewal schedule (or (ISC)²'s CISSP requirements) alongside AAISM's own AI-specific CPE mandate. Neglecting either piece can collapse the whole structure. If you want to understand the full cost picture before mapping out your multi-year commitment, the AAISM Exam Fee: Member vs Non-Member Cost 2026 article breaks down not just the initial exam fee but the ongoing maintenance fees of $20 per year for ISACA members and $35 per year for non-members.
What Counts as an "AI-Specialized" CPE Hour
The phrase "AI-specialized topics" is deliberate. ISACA uses this language to carve out a distinct category from the broader professional education universe. The practical test for whether a CPE activity qualifies is whether its primary subject matter involves artificial intelligence in a professional or technical context - not whether AI is mentioned in passing during a broader security or governance course.
A session on zero-trust network architecture that dedicates one slide to AI-powered threat detection does not qualify as an AI-specialized hour. A dedicated course on machine learning model security, adversarial attack mitigation, or AI governance frameworks does qualify. The distinction matters, and ISACA auditors will look at activity descriptions, not just titles.
Core Subject Areas That Qualify as AI-Specialized CPE
These topic categories align directly with AAISM's three domains and represent the clearest path to earning qualifying hours.
- AI and machine learning model lifecycle security
- Generative AI risk assessment and governance frameworks
- AI ethics, bias auditing, and fairness in automated decision systems
- Regulatory compliance specific to AI (EU AI Act, NIST AI RMF, ISO/IEC 42001)
- Adversarial machine learning and model robustness testing
- AI supply chain risk, including third-party model and dataset risk
- AI incident response and monitoring architectures
- Explainability and transparency requirements for AI systems in regulated industries
- AI program governance, including roles, accountability structures, and board-level reporting
CPE Topics Mapped to Each AAISM Domain
Because AAISM is structured around three distinct domains - each with its own weight - it makes sense to think about CPE not as an undifferentiated pile of hours but as a portfolio that reflects where the credential places its emphasis. Here is how qualifying AI CPE topics map onto each domain.
Domain 1: AI Governance and Program Management (31%)
This domain addresses how organizations structure AI oversight, establish accountability, and build governance programs that are defensible to auditors, regulators, and boards. CPE that qualifies here includes courses on building AI governance frameworks, implementing NIST AI RMF controls, structuring AI review boards, and managing policy development for AI deployment. Training on specific AI-related regulations - including sector-specific rules in financial services, healthcare, or critical infrastructure - falls squarely here.
Domain 2: AI Risk Management (31%)
AI risk management goes well beyond traditional IT risk frameworks. CPE that qualifies for this domain should address how AI-specific threats are identified, assessed, and treated. Topics include AI model risk management, third-party AI vendor risk, dataset integrity and provenance risk, and emerging risk categories like prompt injection, model inversion, and data poisoning. Courses covering AI-specific business impact analysis or AI continuity planning also qualify.
Domain 3: AI Technologies and Controls (38%)
This is the heaviest domain at 38%, and it is where many candidates need the most rigorous CPE investment. Qualifying topics include AI architecture security (covering both training and inference pipeline security), technical security controls for AI systems, AI penetration testing methodologies, model monitoring and drift detection, and MLOps security practices. Deep dives into specific AI platforms, cloud AI service security configurations, and AI-specific logging and observability tools all fit here.
Practicing scenario-based questions that mirror real exam conditions is one of the most efficient ways to identify which domain is consuming your CPE budget without returning knowledge gains. Our AAISM practice tests are built around all three domain areas and can help you audit your knowledge before your next CPE renewal window.
What Does Not Qualify for AI Hours
This is where most AAISM holders are most likely to make an error. The following categories of professional education do not qualify as AI-specialized CPE hours, even if they involve adjacent topics:
| Activity Type | Qualifies for AI Hours? | Why |
|---|---|---|
| General cybersecurity operations course | No | Not AI-specific in primary content |
| CISM renewal CPE (IT governance topics) | No | Satisfies CISM requirement, not AAISM AI-specialized requirement |
| Cloud security architecture (no AI component) | No | AI infrastructure is distinct from general cloud security |
| GDPR/privacy compliance training (generic) | No | Must be AI-specific privacy or AI Act content to qualify |
| AI ethics course with primary focus on AI systems | Yes | AI as primary subject in a professional development context |
| Machine learning security workshop | Yes | Core AI technology security content |
| NIST AI RMF implementation training | Yes | AI-specific regulatory and governance framework |
| Vendor webinar on AI security product features | Potentially | Depends on educational vs. sales content ratio; ISACA auditors may scrutinize |
The double-counting trap is particularly common: professionals assume that hours logged for CISM or CISSP renewal automatically satisfy AAISM's AI-specialized requirement. They do not. You are running parallel CPE obligations, and only the AI-specific hours count toward AAISM's annual 10-hour minimum.
Where to Earn Qualifying AI CPE Hours
Given the specificity of the requirement, it helps to think systematically about where legitimate AI-specialized CPE actually comes from. The following categories represent some of the most credible and auditable sources:
- ISACA-delivered training: Any ISACA course, webinar, or conference session with AI as its primary subject qualifies and is the easiest to document.
- Academic courses: University courses covering AI security, machine learning, or AI ethics from accredited institutions are well-regarded.
- Industry conferences: AI-focused conference tracks at events like DEF CON AI Village, Black Hat AI-specific sessions, or AI governance summits generate qualifying hours if primary content is AI-focused.
- Research and self-study: Reading ISACA-recognized publications, peer-reviewed AI security research, or authoritative standards documents (NIST AI RMF, ISO/IEC 42001) may qualify under self-study provisions - check current ISACA guidelines for hour caps on self-study.
- Teaching and presenting: Delivering a session on AI security topics at a recognized conference or within your organization may qualify, often at a multiplied hour credit.
- Vendor-neutral certification preparation: Formal study for other AI-related credentials can qualify if the content is substantively AI-security focused.
Before logging hours, keep contemporaneous records: activity name, provider, date, number of hours, and a brief description of content. ISACA conducts audits, and vague logs are a liability. AAISM practice test resources can also serve as a structured self-study component when used systematically alongside formal CPE activities.
Annual Minimums vs. Three-Year Cycle Strategy
Ten qualifying hours per year sounds manageable until you account for the dual obligation of maintaining your CISM or CISSP simultaneously. Strategically, the goal is to identify CPE activities that are genuinely AI-specialized - satisfying AAISM - while potentially running parallel to your broader certification maintenance needs.
Some ISACA members find it useful to front-load AI-specialized CPE in the first half of each calendar year, treating the annual minimum as a floor rather than a target. This creates buffer room if professional commitments compress your schedule in Q3 or Q4. It also ensures that if ISACA updates its AI CPE standards (likely as the field evolves), you have completed hours under current guidance rather than scrambling under a new framework at year-end.
Key Takeaway
The three-year cycle total of 30 hours averages to just over two qualifying hours per month. Spreading CPE consistently is far easier than cramming at renewal time - and it keeps your Domain 3 technical knowledge current in a field where AI security threats evolve rapidly.
Scheduling CPE Around AAISM Domain Weights
Because AAISM's three domains carry meaningfully different weights, a thoughtful CPE schedule reflects that structure rather than distributing hours arbitrarily. Here is one practical approach for planning annual CPE aligned to domain emphasis:
Domain 3 Focus: AI Technologies and Controls (38%)
- Prioritize technical AI security CPE: ML pipeline security, adversarial attack workshops, MLOps security
- Attend AI-specific conference tracks or vendor-neutral technical training
- Target 4-5 qualifying hours from technical content
Domain 1 Focus: AI Governance and Program Management (31%)
- Cover AI regulatory developments: EU AI Act implementation, NIST AI RMF updates
- Governance framework courses or ISACA webinars on AI program management
- Target 3-4 qualifying hours from governance content
Domain 2 Focus: AI Risk Management (31%) + Buffer Hours
- AI-specific risk assessment methodologies, third-party AI vendor risk management
- Use remaining capacity to revisit Domain 3 technical content given its rapid evolution
- Ensure annual 10-hour minimum is satisfied before year-end; document all activities
This structure is not rigid - the right allocation depends on your current role, where your knowledge gaps are sharpest, and what qualifies as AI-specialized under ISACA's current guidance. What the structure prevents is arriving at December with eight hours logged and a scramble to find two more qualifying activities before the annual cutoff.
For a broader picture of what the AAISM credential costs across its lifecycle - including how annual maintenance fees compound over three years - see the AAISM Exam Fee: Member vs Non-Member Cost 2026 breakdown. Planning CPE investment alongside financial commitment gives a more realistic view of the full credential cost.
If you are still working toward passing the exam itself and want to make your study hours count toward both exam readiness and eventual CPE-quality knowledge, the AAISM CPE Topics: What Qualifies for AI Hours page is your reference point to bookmark and revisit each renewal year.
Frequently Asked Questions
No. CISM CPE satisfies ISACA's CISM maintenance requirement. AAISM requires a separate pool of AI-specialized hours. General IT governance, audit, or security management CPE does not automatically qualify for AAISM's AI-specific annual minimum unless the primary subject of that activity is artificial intelligence in a professional context.
It depends on content. If the session is primarily educational - covering AI security concepts, threat models, or architectural principles - it may qualify. If it is primarily a product demonstration or sales pitch with educational framing, ISACA auditors may not accept it. When in doubt, seek vendor-neutral educational content and document the session's learning objectives and content description carefully.
AAISM requires that you maintain an active CISM or CISSP throughout the certification's lifecycle. If your prerequisite certification lapses and is not reinstated, your AAISM credential is at risk. CPE planning must account for both the AAISM AI-specialized requirement and the separate maintenance requirements for whichever prerequisite credential you hold.
Yes, in most cases. ISACA typically allows CPE credit for presenting or teaching, often at a higher credit rate than passive attendance. The topic must be AI-specialized and the forum must be a recognized professional venue. Keep documentation including the conference program, your session abstract, and the date of presentation to support any audit.
AAISM specifies a 10-hour annual minimum and 30-hour cycle total. You should confirm with ISACA's current guidance whether excess hours in one year carry forward to reduce a subsequent year's minimum - this is a common point of confusion across ISACA credentials. The safest approach is to treat 10 hours as a hard annual floor and plan CPE accordingly regardless of prior-year totals.
Ready to Start Practicing?
Master all three AAISM domains with scenario-based practice questions built to mirror the real exam's format. Identify your knowledge gaps before they cost you - and build the AI security management expertise that makes CPE hours actually stick.
Start Free Practice Test