The GAICC ISO/IEC 42001 Lead Implementer exam is a 90-minute, closed-book, proctored test of 60 scored questions, and you pass at 70 percent. Forty-five questions have one correct answer. Fifteen ask you to select every correct option, with no partial credit. The credential lasts three years and renews with 40 hours of continuing professional development. Every exam rule on this page comes from the GAICC Candidate Handbook, 1st edition, June 2026.
The GAICC Lead Implementer exam at a glance
| Attribute | Value |
| Standard examined | ISO/IEC 42001:2023, with ISO 19011 (guidelines for auditing management systems) |
| Questions | 60 scored: 45 single-answer (A to D) and 15 multi-answer (A to E, select all that apply) |
| Partial credit | None on multi-answer items |
| Time | 90 minutes, no breaks unless an adjustment is approved |
| Pass mark | 70 percent, confirmed for each exam by a modified Angoff standard-setting study |
| Book policy | Closed book. No notes, devices or assistance |
| Delivery | Online with AI proctoring, or at an approved test center |
| Language | English, others on request |
| Results | On completion: overall score, pass or fail, feedback for each domain |
| Validity | Three years |
| Renewal | 40 CPD hours per three-year cycle |
What the credential certifies: a person’s competence, not an organization’s AIMS
The GAICC ISO/IEC 42001 Lead Implementer credential confirms that an individual can lead an AI management system (AIMS) implementation to ISO/IEC 42001: scoping, AI risk and impact assessment, life cycle controls, operational procedures and audit readiness. It is issued to the named person and cannot be transferred.
Your employer does not become ISO 42001 certified because you pass. Organizations are certified by an independent certification body after a two-stage audit of their management system, a process covered in what ISO/IEC 42001 requires. The two get confused constantly. A job posting that asks for “ISO 42001 certification” is asking about you, so it means a personal credential; a customer’s procurement questionnaire is asking about the company, so it means the audit.
How 60 questions test implementation: 45 single-answer items and 15 with no partial credit
A single-answer question gives four options and one is right. The fifteen multi-answer questions give five options and ask you to select all that apply, and there is no partial credit: a response that is only partly right scores zero. That format punishes half-knowledge. A candidate who knows two of the three required artifacts for a scenario scores nothing on that item.
The pass mark starts at 70 percent and is then confirmed for each exam through a modified Angoff study, a standard-setting method in which subject-matter experts judge how a minimally competent candidate would perform on each item. It keeps the bar steady when one exam form is harder than another.
The Examination Content Outline adds three delivery details worth knowing before exam day. Questions appear in random order. You can flag an item for review while you work through a section. Once a section is submitted, its answers cannot be revisited.
Four domains, weighted by what an implementer actually does
The exam is built to the Examination Content Outline, which splits the credential into four domains. The weights are approximate and can shift slightly between exam forms. The ECO names the domains and tasks; the clause mapping in the third column is ours.
| Domain | Weight | Where it sits in ISO/IEC 42001 | Tasks the ECO names |
| I. Governance and Leadership | 25% | Clause 4 context and scope, clause 5 leadership and AI policy, clause 6.2 objectives | Define AIMS scope and context; approve an AI policy; assign roles; integrate AI objectives; build accountability |
| II. Implementation and Operational Control | 40% | Clause 6.1.2 to 6.1.4, clause 7 support, clause 8 operation | Perform AI risk and impact assessments; implement data governance and life cycle controls; secure resources and competence; control documented information; operate systems under defined controls |
| III. Performance, Audit Readiness and Improvement | 20% | Clause 9 evaluation, clause 10 improvement | Monitor against metrics; run internal audits and management reviews; correct nonconformities; maintain certification readiness |
| IV. Ethics, Transparency and External Engagement | 15% | Annex A controls on impact, information for interested parties, and third-party relationships | Embed ethical principles; explain AI decisions; engage stakeholders; align supplier practices |
Domain II carries 40 percent: risk, impact and life cycle controls
Domain II is the largest share of the exam because it covers the work that turns a policy into an operating system. Clause 6.1.2 requires an AI risk assessment, clause 6.1.3 requires risk treatment and a record of which controls apply, and clause 6.1.4 requires an AI system impact assessment, a requirement with no equivalent in ISO 27001. Clauses 8.2 and 8.4 then ask for the same assessments in operation, at planned intervals or when significant changes are proposed or occur.
The ECO lists the evidence it expects a candidate to recognize here: risk registers, impact-analysis reports, mitigation plans, data-quality and bias-detection procedures, model validation records, change management records, competence matrices and incident logs. If you can say which clause each artifact satisfies, you are studying at the right depth. The full clause 6 picture is in ISO 42001 clause 6 risk requirements.
Domain IV is the smallest, and the easiest to underrate
Fifteen percent looks light, but Domain IV reaches into supplier management. The Annex A category for third-party and customer relationships covers allocating responsibilities and managing suppliers and customers, so an organization that deploys a vendor’s model still has to govern that relationship. Questions on supplier clauses and third-party assurance land here.
Try one: an illustrative select-all question
The question below was written for this guide to show the multi-answer format. It is not taken from the GAICC item bank, which is confidential.
A retailer deploys a vendor’s large language model as a customer-support assistant. It falls inside the scope of the retailer’s AIMS. Which of the following should the retailer be able to evidence for this system under ISO/IEC 42001? Select all that apply.
A. An AI risk assessment that covers the assistant B. An assessment of the assistant’s potential impact on individuals and groups C. A record of which Annex A controls apply to it, and why D. An ISO/IEC 42001 certificate held by the model vendor E. A license to the vendor’s model source code
Answer: A, B and C. A follows from clauses 6.1.2 and 8.2. B follows from clauses 6.1.4 and 8.4. C is the statement of applicability, which clause 6.1.3 requires the organization to produce, with a justification for each control it includes or excludes. D is not required: a vendor certificate can support supplier assurance, but the standard does not demand one, and the retailer’s own assessments and controls are still needed. E is not required at all. A candidate who picks A and B but misses C earns nothing for the item.
Does the exam test recall or judgment? Three cognitive levels
The GAICC exam tests three cognitive levels in every domain, and recall is only the first.
- Understanding: knowing what ISO/IEC 42001 requires and how the standard is structured.
- Application: putting controls and governance mechanisms into practice in a described situation.
- Analysis and evaluation: judging a complex scenario that requires ethical reasoning and a view of the whole system.
Memorizing clause titles gets you through the first level. Scenario items sit in the second and third, which is why implementation experience, even on a small project, is recommended.
Who can sit the Lead Implementer exam?
The Lead Implementer exam has one formal requirement in the Candidate Handbook: at least 32 contact hours of structured ISO/IEC 42001 implementation training from a GAICC-authorized provider or an equivalent recognized institution. GAICC’s ISO/IEC 42001 courses, including the self-paced ones, satisfy it. Foundation-level knowledge of ISO/IEC 42001 is recommended, and implementation experience helps, but neither is a gate.
Holders of the GAICC ISO/IEC 42001 Foundation certification already meet the training requirement and can attempt the exam directly. If you are deciding where to start, the Foundation exam explains the entry tier.
Exam day, from ID check to per-domain results
- Book through the GAICC learning hub. Joining instructions and a system check follow.
- Prepare the room. Online proctoring needs a quiet, private space and a stable connection.
- Show ID. Government-issued photo identification is checked before the exam starts.
- Consent to proctoring. Monitoring may be automated, live or both.
- Sit the exam. A short tutorial comes first and does not count against your 90 minutes. No breaks are allowed unless an adjustment was approved at booking.
- Read your results. You see your overall score, pass or fail, and performance for each domain as soon as you finish. Results can be confirmed after a standard post-exam integrity review.
Candidates who need extra time or assistive technology should request a reasonable adjustment at booking, with supporting information.
When a first attempt fails: resits, intervals and the 12-month window
Each Lead Implementer exam registration includes one attempt. If you do not pass, you may resit at a discounted re-examination fee, subject to two limits: at least 30 days between attempts, and no more than two resits within 12 months. After that, you retake under a new registration.
The per-domain feedback is the most useful thing a failed attempt gives you. A candidate who scores well on Domains I and III but poorly on Domain II knows where the next 30 days should go.
Exam fee versus course package: what the GAICC credential costs
The Lead Implementer credential has two published prices, and they buy different things.
| What you buy | Price | What is included |
| Examination only, non-member | US$249 | One exam attempt |
| Examination only, member | US$149 | One exam attempt, for current members |
| GAICC annual membership | US$99 per 12 months | Bought separately from the exam fee |
| Course package, full price | US$875 | 16 modules, 32 CPD hours, exam simulator, one exam voucher |
| Course package, member price | US$698 | The same package, including the US$99 membership |
Exam fees come from the Candidate Handbook; package prices come from the course page on 21 September 2026. The package also satisfies the 32-hour training requirement, which the exam-only fee does not. The course modules and current dates are on the page for the GAICC ISO 42001 Lead Implementer course.
Why “exam dumps” fail on this exam
“ISO 42001 lead implementer exam dumps” is a real search, so here is the direct answer. GAICC examination content is confidential. Copying, recording or sharing it is misconduct, and the consequences named in the handbook are result invalidation and withdrawal of the certification.
A dump would not help much anyway. Scenario items change their facts, the answer depends on which clause the situation triggers, and a multi-answer item scores nothing unless every correct option is chosen. Memorized letter patterns do not survive that.
How to split 30 to 40 study hours across the four domains
GAICC recommends 30 to 40 hours of focused study for the Lead Implementer exam. A plan that follows the exam weights looks like this, based on 35 hours:
| Domain | Weight | Hours | Spend them on |
| II. Implementation and Operational Control | 40% | 14 | Clauses 6.1.2 to 6.1.4, clause 8, the Annex A categories for data, life cycle and resources |
| I. Governance and Leadership | 25% | 9 | Scoping under clause 4, the AI policy, roles and objectives |
| III. Performance and Improvement | 20% | 7 | Internal audit, management review, corrective action, ISO 19011 audit principles |
| IV. Ethics and External Engagement | 15% | 5 | Transparency, stakeholder communication, supplier controls |
Leave the last few hours for timed practice. The course package includes an exam simulator, and 90 minutes for 60 questions allows an average of 90 seconds per item, less for the multi-answer questions if you want time to review flags.
Is the Lead Implementer credential worth it in 2026?
Demand for Lead Implementers comes from a gap between AI adoption and AI governance, and recent surveys measure that gap directly.
In ISACA’s 2026 AI Pulse Poll of more than 3,400 digital trust professionals, published 5 May 2026, only 38 percent said their organization has a formal, comprehensive AI policy. In the Stanford AI Index 2026 survey run with McKinsey, 36 percent of respondents named ISO/IEC 42001 as a standard shaping their responsible AI practices, in its first year as an option, and knowledge and training gaps were the top obstacle to implementing responsible AI, rising from 51 percent in 2024 to 59 percent in 2025.
The US reference framework points the same way. NIST’s AI Risk Management Framework says, under GOVERN 2.2, that an organization’s “personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities.”
Keep one number in proportion. The same AI Index, using Lightcast data, found that AI ethics, governance and regulation skills appeared in 0.05 percent of all US job postings in 2025. Dedicated roles are still rare. For most readers, the realistic value is adding the credential to an existing role in security, privacy, risk or compliance, rather than expecting a new job title. Careers after the Lead Implementer credential covers the roles in more detail.
Keeping the credential: 40 CPD hours per three-year cycle
The Lead Implementer credential stays valid for three years if you log 40 CPD hours across four categories.
| CPD category | Examples | Hours per cycle |
| Learning | Courses, webinars, conferences, structured study | 15 |
| Practice | Applied work in the certified domain | 15 |
| Contribution | Writing, presenting, mentoring, committee or standards work | 5 |
| Elective | Other relevant professional development | 5 |
| Total | 40 |
Renewal also means reaffirming the GAICC Code of Ethics and staying in good standing. A three-month grace period follows expiry. Re-examination is required if CPD evidence falls short, if the credential lapses beyond the grace period, or if the standard or scheme changes materially.
Frequently asked questions
Is the GAICC Lead Implementer exam open book?
No. It is closed book: no notes, devices or assistance are permitted. That differs from some other providers’ 42001 exams, so check the rules of whichever exam you are booking.
How long is the exam and how many questions does it have?
It runs 90 minutes and contains 60 scored questions: 45 single-answer and 15 multi-answer. A short tutorial beforehand does not count toward the time.
Do I need the Foundation certificate first?
No. Foundation-level knowledge is recommended, not required. The formal requirement is 32 contact hours of structured implementation training, and a GAICC Foundation certificate satisfies it.
Can I take the course without sitting the exam?
Yes. You can attend the course to gain the knowledge and CPD hours without attempting the exam.
Does passing make my company ISO 42001 certified?
No. The credential certifies you. An organization is certified only after an independent certification body audits its AI management system.
Are there practice questions?
The course package includes an exam simulator. The live exam’s items are confidential, so treat any site selling “real” questions as a misconduct risk rather than a shortcut.
What happens if the platform fails during my exam?
GAICC’s Examination Content Outline states that a session affected by a confirmed technical error or system irregularity entitles the candidate to a free re-examination.
