AAIR career: AI risk roles and next steps
AAIR points at risk officers and IT risk professionals who now have AI on their register, not at a new job title. ISACA describes the audience as experienced IT risk professionals who work across functions on AI risk response, and the same page requires an active qualifying designation such as CISA, CISM, CRISC, CGEIT or CDPSE before the credential can be awarded. It lists no job titles of its own, so the roles below are an interpretation, labelled as such, rather than something ISACA promises. Details are on ISACA’s AAIR page.
Who ISACA says AAIR is for
The official wording is short: experienced IT risk professionals, plus active holders of ISACA and other recognised designations. The page lists “proven experience in IT risk or advisory roles” among the standards for professionals, but it does not make that a formal gate. The only hard requirements are a qualifying designation, a passed exam, the US$50 application fee and adherence to ISACA’s ethics and CPE policies.
That makes AAIR a layer, not a starting point. The prerequisites page covers the long designation list. For career purposes, the useful reading is that AAIR describes what an existing risk, audit, privacy or security professional is expected to do about AI, not a separate profession.
AI risk work versus enterprise risk work
Because ISACA names no titles, the practical question is how AI risk differs from the risk job already in the building. The three domains give the clearest answer: governance and framework integration (37%), AI life cycle risk management (21%) and AI risk programme management (42%).
| Where the work sits | Typical existing title (example, not ISACA’s wording) | What AAIR-style work adds |
|---|---|---|
| Second line, IT risk | IT risk manager or analyst | AI scenarios in the register, drift-aware thresholds, model owners |
| Second line, enterprise risk | Enterprise risk manager, operational risk lead | Aggregating AI exposure across business units and suppliers |
| Privacy and data governance | Privacy lead, data protection officer | Training data, provenance and regulatory mapping |
| Project and programme risk | Project risk specialist | Risk profiles for AI projects that have no template |
| Third-party risk | Vendor risk manager | Silent provider changes, model supply chain, concentration |
An enterprise risk officer rarely needs the lifecycle detail; an IT risk analyst embedded with a data science team does. The exam weights reflect the first profile more than the second, which is why programme management carries the most marks.
What passing AAIR does not prove
- Technical ability. Nothing on the exam asks you to build, tune or test a model. Someone hiring a machine learning engineer or a security engineer will not read AAIR as evidence of that skill. For hands-on roles, SC-500 or CY0-001 say more.
- Audit competence. Assurance work is the territory of AAIA, which carries an audit-shaped syllabus.
- Security management. That belongs to AAISM, which sits on CISM or CISSP.
- Current practice. An active credential shows CPE compliance, not that you handled a specific AI incident well.
A reasonable sequence after AAIR
- Stay current on the base designation. AAIR only stands while the qualifying credential stays active, so CRISC, CISA or whichever you used keeps its own CPE cycle. See renewal and retakes.
- Read the siblings only if your remit grows. Holding AAISM or AAIA alongside AAIR makes sense for a head of risk who also owns security or assurance, but the overlap is large; the ISACA AI path lays out the three side by side.
- Add a different kind of evidence. A vendor-neutral technical credential such as CY0-001 or Microsoft’s AI-901 fills in vocabulary a risk exam assumes you can borrow from engineers.
- Compare with CRISC if you lack it. If you hold none of ISACA’s designations, AAIR vs CRISC explains why CRISC can be the entry route to AAIR.
Where to check AAIR pay and demand
This guide quotes no salary or hiring numbers, because ISACA publishes none for AAIR and no source checked supports one. For general risk roles, the US Bureau of Labor Statistics Occupational Outlook Handbook and O*NET are the neutral places to check; job adverts in your own market say more about how often AAIR is requested than any survey would.
AAIR holders and CRISC: three common questions
Does AAIR replace CRISC? No. CRISC is one of the designations that qualifies you, and it must stay active.
Is it a jump into data science? No. The exam tests how to govern and treat AI risk, not how to build the systems.
Is it worth it for a risk officer at a small firm? It depends on whether AI actually appears in your register; the worth-it guide covers the cost side.
Ready to test your fit? Try the free sample questions.