The GAICC ISO/IEC 42001 Foundation exam is a closed-book, proctored test of 40 multiple-choice questions that certifies awareness-level knowledge of the AI management system standard. The Global AI Certification Council (GAICC) requires 16 contact hours of training or self-paced learning before you take its proctored 40-question exam. You have 60 minutes, you pass at 70 percent, and the credential lasts three years.
Each pass certifies one person. Organizations reach certification by a separate audit route. Other issuers set their own entry-level tests, and a pass with one of them does not transfer to GAICC or the other way round. If you are still picking a course, the GAICC ISO/IEC 42001 Foundation course lists what the package includes.
What the Foundation credential proves
Passing the Foundation exam shows that you understand what ISO/IEC 42001 asks for and the reason behind each requirement. The GAICC Candidate Handbook (1st edition, June 2026) calls this “awareness-level competence” in AI governance and the AI management system (AIMS). The Foundation Examination Content Outline is blunter: the examination “is not an implementation or audit qualification.”
That boundary shows up in hiring and in procurement. In hiring, the certificate supports a claim of literacy in the standard and says nothing about whether you have built an AIMS. In procurement, it says nothing about your employer, because organizations become certified only after an independent certification body audits their management system. What ISO/IEC 42001 requires of US organizations explains that second route.
The outline names its intended candidates: compliance teams, AI practitioners, auditors, project managers, data professionals and policy specialists. The Handbook adds newcomers to AI governance and calls the credential the entry point to the Internal Auditor, Lead Implementer and Lead Auditor pathways. It is a GAICC-issued personnel certification. It “applies to the named individual, is not transferable,” and may not be used to suggest accreditation that was never granted.
Take the Foundation exam or skip it
Take the Foundation exam if you will support an AIMS without leading it, and skip it if you will build or audit one soon. GAICC does not require the Foundation certificate before any higher exam. Its Lead Implementer and Lead Auditor Handbooks recommend Foundation-level knowledge without requiring the credential.
| Your situation | Take Foundation? | Why |
| New to AI governance or changing careers | Yes | A first examined credential and a structured tour of the standard |
| Compliance or risk analyst supporting the AIMS | Yes | Shared vocabulary for AI policy, risk and impact assessment |
| Data scientist or ML engineer | Yes, if you need the vocabulary | Explains why life cycle controls and documentation requests exist |
| Product or project manager | Yes | Shows where AI objectives, roles and change control sit in the standard |
| Internal audit staff | Yes, before audit training | Clause structure first, then the Internal Auditor route |
| ISO/IEC 27001 or ISO 9001 implementer about to lead an AIMS | Usually skip | The Lead Implementer course covers the same ground at build depth |
| Auditor for a certification body | Usually skip | Start on the Lead Auditor route |
The decision table is GAICC editorial guidance. One rule in GAICC’s own documents tips the choice for some readers. According to the Lead Implementer Examination Content Outline, GAICC Foundation holders “automatically meet the training requirement” for the Lead Implementer exam and may attempt it directly. The Lead Implementer Handbook does not repeat that line, so confirm it with support@gaicc.org before you plan around it.
Auditors who already hold an ISO/IEC 27001 Lead Auditor credential often ask whether to start at Foundation. GAICC’s Lead Auditor Handbook recommends knowledge at Foundation level plus familiarity with auditing, and it does not require the certificate. If you can already name clauses 4 to 10 and explain the AI impact assessment, the Lead Auditor route is open to you directly.
What you need before you can book
The only formal entry rule for the Foundation exam is training: 16 contact hours or more of structured fundamentals training on ISO/IEC 42001. Training from a GAICC-authorised provider or an equivalent recognised institution qualifies, as do GAICC’s self-paced courses. There are no education or experience prerequisites.
Two practical points sit beside that rule. The content outline expects “basic familiarity with AI concepts, data ethics, and organisational governance” before you sit. Most people in governance or technical roles already have it. GAICC’s course page also lists the certificate of completion as required for exam eligibility, so keep it where you can find it when you book.
What it costs, and what is free
The Foundation exam costs US$199 on its own, or US$99 if you already hold a GAICC membership, and no GAICC document lists a free attempt. Membership is sold separately at US$99 a year.
| Item | Price | What it includes |
| Exam only, non-member | US$199 | One attempt |
| Exam only, member | US$99 | One attempt; membership bought separately |
| Course package, full price | US$675 | Seven self-paced modules over two days that meet the 16-hour training rule, exam simulator, one exam voucher, 90, 180 or 360 days of access |
| Course package, member price | US$498 | The same package, with the US$99 membership included |
| Resit | Discounted fee | Published annually by GAICC; the Handbook gives no figure, so confirm it before booking |
Much of the preparation costs nothing. The Handbook and the content outline are free downloads. The clause skeleton of ISO/IEC 42001:2023 follows the harmonized structure ISO sets for all management system standards. That common text is free to read in Annex SL of the ISO/IEC Directives. The AI-specific parts, including the impact assessment clause and Annex A, sit only in the paid standard. The eligibility rules do not require you to buy it. The course can also be taken without the exam. The cost of GAICC credentials compares these prices with the higher levels.
Once you decide to sit it, the exam’s rules shape how you prepare.
Foundation exam at a glance
The Foundation exam gives you 60 minutes for 40 single-answer questions, closed book, with a 70 percent pass mark. Every row below comes from the Candidate Handbook.
| Attribute | GAICC rule |
| Standard | ISO/IEC 42001:2023 |
| Level | Foundation (awareness) |
| Format | 40 multiple-choice questions (online proctored), each single-answer with four options, A to D |
| Duration | 60 minutes, with no breaks unless an adjustment is approved |
| Passing score | 70 percent, provisional until a modified Angoff review confirms it for each exam |
| Book policy | Closed book: no notes, no devices and no help |
| Delivery | Remote with AI proctoring, or in person at an approved test center |
| Language | English as standard; ask GAICC about other languages |
| Training required | 16 or more contact hours of structured fundamentals training on the standard; GAICC self-paced courses count |
| Experience required | None |
| Attempts | One per registration; resits follow the retake policy |
At the provisional mark, 28 correct answers out of 40 pass, which leaves room for 12 misses. Forty questions in 60 minutes gives you 1.5 minutes per item.
You book the exam in GAICC’s learning hub, which emails the joining details and a system test. On the day, keep a government photo ID at hand and sit somewhere private where nobody will walk in, on a connection you trust. Three rules from the content outline affect pacing. The question order is shuffled, and you can flag any item to revisit until its section is submitted, after which those answers lock. At zero the timer submits the paper for you. Adjustments such as more time or assistive tools are requested when you book, with evidence of need. The check-in and proctoring steps are shared with the higher exams, and the exam day walkthrough in the Lead Implementer exam guide covers them.
What the exam tests
The Foundation exam samples three domains, weighted roughly 40, 40 and 20 percent, and the Handbook notes that weightings “may vary slightly by form.” The last column is GAICC editorial guidance on where questions tend to focus.
| Domain | Weight | Content outline tasks (summarized) | Expect items on |
| I. Fundamentals of AI Governance and the ISO/IEC 42001 Framework | about 40% | Purpose and scope; key terms; clauses 4 to 10 and Plan-Do-Check-Act; links to ISO/IEC 27001, ISO/IEC 27701 and ISO 9001; risk-based thinking | Clause titles in order and which PDCA phase each clause serves |
| II. Core Components of the AIMS | about 40% | Main requirements of clauses 4 to 10; purpose of the AI policy; AI risk and impact assessment; operational controls and documentation; performance evaluation and improvement | What each clause asks for, and which record proves it |
| III. Responsible AI, Ethics and Stakeholder Awareness | about 20% | Ethical principles; transparency and explainability; internal and external stakeholders; communication that builds trust | Principles by name, and who each stakeholder group is |
Two cognitive levels are tested. Knowledge means recall of concepts, terminology and clause intent, and comprehension means understanding how AIMS elements and ethical principles relate. In the outline’s words, questions “test recognition and conceptual clarity rather than technical configuration or audit judgement.”
Domain I asks how the standard relates to its siblings, and how ISO/IEC 42001 compares with ISO/IEC 27001 covers that comparison in full. For the risk items in Domain II, the risk management requirements in clause 6 make a useful companion read.
What each clause asks an organization to produce is laid out in GAICC’s clause-by-clause reference for clauses 4 to 10.
How the questions look
Foundation questions ask where the standard puts a requirement and why it exists, with one correct option out of four. The item below is illustrative. GAICC editors wrote it to show the format, and it is not drawn from the live item bank.
An organization must decide what knowledge its AI model reviewers need, train them, check that the training worked, and keep records of it. Which ISO/IEC 42001 clause sets this requirement?
A. 5.3 Roles, responsibilities and authorities B. 7.2 Competence C. 7.3 Awareness D. 9.2 Internal audit
B is correct. Clause 7.2 covers determining the competence people need, acquiring it, evaluating the action taken and keeping evidence. Option C is the classic trap, because awareness concerns what people must know about the AI policy and their own contribution. Option A assigns roles without testing whether the people in them are competent, and option D audits the AIMS as a whole.
Items that paraphrase the standard reward the candidate who knows the purpose behind a requirement as well as its title. Picking the best treatment for a risk scenario belongs to the Lead Implementer paper.
Wrong options on recall papers tend to come from neighboring clauses that sound alike. The pairs below are worth separating before the exam; the distinctions paraphrase the standard’s clause titles and are GAICC editorial guidance.
| Pair | How to tell them apart |
| 6.1.2 AI risk assessment and 6.1.4 AI system impact assessment | Risk to the organization’s AI objectives, against consequences for individuals, groups and societies |
| 7.2 Competence and 7.3 Awareness | Skills people need and proof they have them, against knowing the policy and their own part in it |
| 9.2 Internal audit and 9.3 Management review | Checking conformity at planned intervals, against top management reviewing whether the AIMS still fits |
| 5.2 AI policy and 6.2 AI objectives | The framework top management sets, against measurable targets planned under it |
A study plan by hours
Plan your study by the hours you have after the 16 required training hours, and weight them by the domain shares. GAICC publishes no recommended study time beyond those 16 hours. The plan below is therefore illustrative, built only from the outline’s 40, 40 and 20 percent weights.
| Study block | 6 extra hours | 10 extra hours | 14 extra hours | What to do |
| Domain I | 2 | 3.5 | 5 | Recite clauses 4 to 10 in order, with the PDCA phase each one serves |
| Domain II | 2 | 3.5 | 5 | Pair each clause with its evidence: policy, risk assessment, impact assessment, competence records, audit reports |
| Domain III | 1 | 2 | 3 | Learn the ethics terms by name: fairness, accountability, non-discrimination, privacy, human oversight, transparency, explainability |
| Timed run on the simulator | 1 | 1 | 1 | Forty questions in 60 minutes, then review every miss by domain |
Spread the blocks over separate days. Quiz yourself from memory instead of rereading notes, and keep the simulator run for the end. A 2006 study of test-enhanced learning found that repeated recall beat rereading on delayed tests, which suits a recall-level exam. The documents the standard requires gives the full evidence list for the Domain II pairing. You do not need your own copy of the standard, and the closed-book rule makes one useless in the room.
After the last question, the result appears on screen and the post-exam steps begin.
Results and your certificate
The result appears on screen as soon as you submit. It shows an overall score, a pass or fail decision and a breakdown for each of the three domains. GAICC may confirm a provisional result after its routine integrity review. A pass brings a certificate plus a digital badge, and the course page names the credential “GAICC Certified ISO/IEC 42001 Foundation.”
You can describe yourself as holding the credential for as long as it stays valid. The certification mark may be used under GAICC’s rules for certificates and marks. The credential is yours alone, and an employer cannot take it over.
If you do not pass, the Handbook sets the resit rules.
| Rule | GAICC Foundation |
| Attempts per registration | One |
| Resit price | Discounted re-examination fee for each resit |
| Wait between attempts | At least 30 days |
| Resits allowed | Up to two in 12 months, then a new registration |
Use the per-domain feedback to rebuild the study plan above, putting the extra hours where your score dropped. A session hit by a confirmed technical failure is a separate case, and the content outline promises a free re-examination for it.
Validity and renewal
A Foundation certificate stays valid for three years from the day you are certified. To renew, log 40 CPD hours (continuing professional development) during those three years, reaffirm your commitment to GAICC’s Code of Ethics, and stay in good standing.
| CPD category | Hours per three-year cycle | What counts |
| Learning | 15 | Courses, webinars, conferences, structured study |
| Practice | 15 | Applied work in the certified domain |
| Contribution | 5 | Writing, talks, mentoring, or committee and standards work |
| Elective | 5 | Other relevant professional development |
After expiry you have three months of grace. A new exam is required if your CPD evidence falls short or the lapse runs past the grace period. It is also required if the standard or the certification scheme is materially revised. The Handbook says GAICC publishes renewal fees annually but prints no amount, so confirm the fee with GAICC before your cycle ends.
Expiry rules differ across issuers, and at least one large issuer’s entry-level certificate needs no maintenance at all. Check expiry in the issuer’s handbook before you compare prices, since an expiring credential carries an ongoing time cost.
Your next step: implementer or auditor
The next step after Foundation depends on whether you will build an AIMS, audit one from inside, or audit one for a certification body. The Handbook names Foundation as the entry point to all three routes.
| Where you stand | Next move |
| About to lead or run an AIMS implementation | Lead Implementer; read the exam guide linked above first |
| Moving into internal audit of an AIMS | The Internal Auditor exam guide sets out that credential |
| Planning to audit for a certification body or as a consultant | The guide to the Lead Auditor exam covers the auditor route |
| Torn between building and auditing | Read the Lead Implementer or Lead Auditor decision first |
| Supporting an AIMS with no lead role in view | Stay at Foundation and log CPD through practice hours |
If you are heading for the build route, you can step up to the Lead Implementer course. Its four days cover clauses 4 to 10, risk and impact assessment, and preparation for certification. That paper asks for decisions a 16-hour awareness course never rehearses: 60 questions in 90 minutes, 15 of them select-all. Booked on its own, the Lead Implementer exam costs US$249, or US$149 for members. If you plan to rely on the outline’s training exemption for Foundation holders, ask GAICC support to confirm it first.
Using the Foundation credential at work
At work, the Foundation credential supports roles that sit around an AIMS and supplies competence evidence for the organization running it. GAICC’s Foundation course page names four roles it prepares people for: AI Compliance Associate, Responsible AI Analyst, Risk and Governance Assistant, and Junior IT or AI Auditor. None is a lead role.
For the organization, a pass produces records for clauses 7.2 and 7.3 of ISO/IEC 42001. Clause 7.2 asks the organization to define the competence that work affecting AI performance needs. It must then make sure people have it, check whether its actions worked and keep evidence. Clause 7.3 asks that people know the AI policy, their contribution and what follows if they do not conform. The mapping below is GAICC editorial analysis and is not an auditor’s checklist.
| Clause duty | What a Foundation record supplies | What it leaves to the organization |
| 7.2: determine needed competence | Nothing; the organization defines role requirements | Competence profiles for each AIMS role |
| 7.2: ensure competence | 16 contact hours plus an examined pass | Implementation or audit skill for lead roles |
| 7.2: evaluate effectiveness | A 70 percent pass and per-domain feedback | On-the-job performance review |
| 7.2: documented evidence | Training certificate, credential certificate, badge | The competence register and record retention |
| 7.3: awareness | Examined knowledge of what an AI policy is for | Briefing staff on the organization’s own AI policy |
Awareness of a policy presumes the policy exists. ISACA’s 2026 AI Pulse Poll, published on 5 May 2026, found 38 percent of organizations with “a formal, comprehensive AI policy.” The figure was 28 percent in 2025. Under GOVERN 2.2, the NIST AI Risk Management Framework expects that “personnel and partners receive AI risk management training.” Organizations with EU exposure face Article 4 of the EU AI Act, as amended by the Digital Omnibus on AI. It asks providers and deployers to “take measures to support the development of AI literacy of their staff.”
Teams can enroll together. GAICC’s Corporate or Enterprise membership costs US$3,200 a year for up to 50 staff. At that tier, the membership page lists a 25 percent discount on certifications, training and exams. Building wider competence evidence for AIMS teams has its own guide.
Frequently Asked Questions
Is the ISO/IEC 42001 Foundation exam open book?
No, GAICC runs the Foundation paper closed book, whether you sit it under online AI proctoring or at an approved test center. You may not bring notes or devices or receive help, and breaks need an approved adjustment. Plan to recall clause titles and their purpose from memory, since nothing in the room will remind you.
Is the Foundation exam hard?
Most of the challenge lies in recall. The content outline limits the paper to knowledge and comprehension, with items written to check recognition and conceptual clarity. Candidates who can name clauses 4 to 10 in order and explain what each one is for have covered the core of the outline.
How many questions can I get wrong and still pass?
At the provisional 70 percent mark you need 28 correct answers out of 40, so you can miss 12. GAICC confirms the cut for each exam form through a modified Angoff study. In it, experts judge how a borderline but competent candidate would do on every item, so the exact figure can move.
What happens if a technical problem interrupts my exam?
GAICC’s content outline promises a free re-examination without penalty when a session is affected by confirmed technical issues or system irregularities. A failed attempt is a different matter and follows the paid resit rules. If the platform fails you mid-exam, tell support@gaicc.org at once so the problem can be confirmed.
Will my employer become ISO/IEC 42001 certified if I pass?
No. Your Foundation certificate is personal to you and cannot move to an employer. Organizations earn ISO/IEC 42001 certification through their own audit by a certification body. Your pass can still sit among the clause 7.2 and 7.3 records your employer keeps for that audit.
Do Foundation holders pay less for the Lead Implementer exam?
None of the GAICC handbooks or outlines lists a price discount for Foundation holders. The saving lies in training: the Lead Implementer content outline says Foundation holders meet that exam’s training requirement, so an exam-only booking at US$249 (US$149 for members) may be enough. Confirm this with support@gaicc.org first, because the Lead Implementer Handbook does not repeat it.
Can I share the Foundation badge online?
Yes. Passing candidates receive a digital badge with the certificate, and the course page describes it as secure, verifiable and shareable. Under the Handbook you may state that you hold the certification while it is valid. Use must stop if it lapses or is withdrawn.
