Picture a compliance lead in Denver in the autumn of 2025. Her company screens job applicants with an AI tool, so she spends months building what Colorado's SB 24-205 asks for: a risk management program, annual impact assessments, and a documented duty of care. The law is due to apply on June 30, 2026.
It never applies. On May 14, 2026, Colorado's governor signed SB 26-189, which repeals the original act and replaces it with a narrower notice-and-transparency law starting January 1, 2027. Most of what she built is no longer something Colorado requires.
Most people preparing for AAISM AI regulations questions start the way she did. They pick the laws that seem to matter and learn their requirements. Then the laws move. This year the EU pushed its main high-risk deadline back 16 months, South Korea's first broad AI law went live with a grace period on fines, and a December 2025 executive order set up a federal task force to challenge state AI laws in court.
The parts of her project that survived were the inventory of AI systems, the assessment method, and the evidence trail. Those are the parts of the AAISM tests.
What Does AAISM Cover on AI Regulations?
AAISM treats AI regulation as a management responsibility. You're tested on how you bring an organization into line with regulatory requirements and keep it there, and the exam outline doesn't name any single law. ISACA's AAISM exam content outline places regulation in Domain 1, AI Governance and Program Management, which makes up 31% of the 90-question exam. Section A of that domain groups stakeholder considerations, industry frameworks, and regulatory requirements under one heading. That grouping is a hint about how ISACA sees them: as inputs to the same governance decisions.
Regulation also runs through the supporting tasks well beyond Domain 1. Four of them carry most of the weight:
ISACA supporting task | What it asks you to do | Where regulation comes in |
|---|---|---|
Task 3 | Make sure AI is used responsibly, drawing on leading practices, ethics, regulatory requirements, and industry frameworks | Laws sit next to frameworks like the NIST AI RMF and ISO/IEC 42001 as sources of requirements |
Task 6 | Watch internal and external factors that signal AI risk needs reassessing | A new or amended law is one of those external factors |
Task 8 | Run AI impact assessments and confirm conformity with regulatory requirements | The assessment is the evidence a regulator asks to see |
Task 15 | Investigate, document, and report AI security incidents as regulations and contracts require | Reporting duties change by jurisdiction and by contract |
Domain 3 picks up the other half. Its privacy, ethical, trust, and safety controls are where requirements like the EU AI Act's human oversight and bias monitoring become things you implement and test. Our Domain 1 guide covers what each major framework requires, and the Domain 3 guide covers the controls.
For eligibility and exam logistics, start with the AAISM certification guide. If you think better in diagrams, the free AAISM MindMaps give AI regulation, standards, and frameworks their own map in section 1.2.
Global AI Governance in 2026: Where the Major Rules Stand
Global AI governance in 2026 is a patchwork. The EU and South Korea each run a broad national regime, a handful of US states regulate specific uses, and the US federal government is pushing back against the states. Here's where the rules you're most likely to meet stand as of September 2026:
Jurisdiction | What it regulates | Status (September 2026) | Closest AAISM task |
|---|---|---|---|
EU AI Act | Risk tiers from prohibited to minimal, with the heaviest duties on high-risk systems and general-purpose AI models | Prohibitions since February 2025; general-purpose AI rules since August 2025; enforcement and transparency rules from August 2, 2026; high-risk rules for sensitive use cases such as employment from December 2, 2027; high-risk AI inside regulated products from August 2, 2028 | 3, 8, 20 |
Colorado SB 26-189 | Automated decision-making technology used in consequential decisions such as hiring, housing, and lending: notices and review rights | Signed May 14, 2026; effective January 1, 2027; attorney general rulemaking under way | 13, 20 |
Texas TRAIGA (HB 149) | A list of prohibited intentional AI uses, enforced by the attorney general | In effect since January 1, 2026; substantial compliance with a recognized framework such as the NIST AI RMF is an affirmative defense | 3, 7 |
California | SB 53: transparency and incident reporting for large frontier model developers. AB 2013: training data summaries for generative AI. CPPA rules on automated decision-making | SB 53 and AB 2013 in effect since January 1, 2026; the CPPA's significant-decision obligations begin January 1, 2027 | 14, 15 |
Illinois HB 3773 and NYC Local Law 144 | AI in employment decisions; NYC adds bias audits for automated hiring tools | Illinois in effect since January 1, 2026; NYC since 2023 | 9, 20 |
South Korea AI Basic Act | Risk management, impact assessments, and human oversight for high-impact AI; labeling for generative AI; reaches foreign companies serving Korean users | In effect since January 22, 2026; fines generally deferred for at least a year | 8, 13 |
US federal | No broad federal AI statute; a December 2025 executive order targets state AI laws | A Justice Department task force is challenging state laws in court | 6 |
The European Commission keeps the official EU AI Act timeline current, and the US International Trade Administration's overview of Korea's AI Basic Act is written for companies entering that market. Look at the status column again. Almost every entry is either less than a year old or hasn't started yet.
Looking for some exam prep guidance and mentoring?
Learn about our personal mentoring
Why Memorizing AI Laws Is the Wrong Way to Prepare
The usual approach to AI regulation prep is a list of laws and dates. Several of those dates changed in the last twelve months, so a list learned in 2025 now gives wrong answers.
Colorado alone moved twice. The original act was due on February 1, 2026, slipped to June 30, 2026 after a special legislative session in August 2025, and was then replaced outright by SB 26-189, which drops the original law's risk management program and annual impact assessments. The EU made a bigger move. Its AI Omnibus amendment, agreed on May 7, 2026 and in force since July 27, 2026, pushed high-risk obligations for sensitive use cases from August 2026 to December 2, 2027, pushed high-risk AI in regulated products to August 2, 2028, and added a ninth prohibited practice, covering AI "nudification" apps, from December 2026.
Memorize AI statutes, and you're memorizing a train timetable the week before the rail company rewrites it. You'll know every departure and still miss your train. What gets you home is reading the departure board: which line you're on, and what a delay does to your connection.
AAISM is built around reading the board. Task 6 asks you to notice when an external change means risk needs reassessing, which is the moment the board flips from "on time" to "delayed." Task 8 asks you to run an assessment and confirm conformity, which is checking your connection before you run for the platform. A question hinging on a specific deadline would have gone stale twice this year, which is a good reason to expect the exam to ask what you'd do when a rule changes. Spend your prep there.
The Controls Every AI Regulation Keeps Asking For
Four artifacts show up in nearly every AI law in force or on the way: an AI inventory with risk classification, a risk or impact assessment, documentation and logs, and human oversight with a way to review decisions. Build those once, and most new laws become a mapping exercise.
Artifact | Which rules ask for it | AAISM task |
|---|---|---|
AI inventory and risk classification | EU AI Act (the risk tier decides your obligations); South Korea (whether a system counts as high-impact); Colorado SB 26-189 (whether a tool is used in a consequential decision) | 13 |
Risk and impact assessment | EU AI Act (risk assessment and mitigation for high-risk systems); South Korea (impact assessments for high-impact AI); Texas (problems your own testing or audits find and fix count toward an affirmative defense) | 8 |
Documentation and logging | EU AI Act (technical documentation and activity logs); Texas (documented alignment with the NIST AI RMF supports the defense); South Korea (documented risk management) | 8, 15 |
Human oversight and review | EU AI Act (human oversight measures for high-risk systems); Colorado SB 26-189 (human review in consequential decisions); South Korea (oversight for high-impact AI) | 20 |
The Colorado rewrite shows why this works. The new law dropped annual impact assessments. A team that built a general assessment method lost nothing, because the same method still feeds the EU's high-risk requirements, Korea's impact assessments, and the Texas defense. A team that built a Colorado-specific assessment has to rebuild it for each of those. That's why frameworks like the NIST AI RMF and ISO/IEC 42001 make a better backbone than any one statute, with jurisdiction-specific work layered on top. Our guide to AI model governance shows how that backbone looks in practice, and AAISM for privacy professionals covers where it overlaps with GDPR work you may already do.
How AAISM Tests Regulatory Compliance: A Worked Question
AAISM tends to test regulation through scenarios where every option is a sensible action and the real question is which one comes first. Here's an exam-style question we wrote for this article to show the pattern:
A global retailer plans to roll out a vendor's AI CV-screening tool to hiring teams in Germany and Colorado in March 2027. Legal counsel has confirmed the EU use falls in a high-risk category. The CIO asks the AI security manager what should happen first. What is the BEST response?
A. Request the vendor's bias testing results and model documentation.
B. Add the tool to the AI inventory, classify it against each applicable requirement, and complete an AI impact assessment before deployment.
C. Schedule EU compliance work for later in 2027, since high-risk obligations for employment tools don't apply until December 2027.
D. Require a human recruiter to review every candidate the tool rejects.
The best answer is B.
A is work you'll do. The vendor evidence feeds the assessment, which makes it the second step. Ask for it first and you don't yet know which evidence you need, so you'll either ask for too little or drown in documents that answer the wrong questions. Our Domain 2 guide covers vendor risk in more depth.
C is the regulation-memorizer's trap. The December 2027 date is correct for the EU, and the option still fails twice. Colorado's law applies from January 1, 2027, before the March rollout. And deploying a high-risk system with no assessment at all is a risk decision, one the security manager shouldn't defer because an enforcement date is still months away.
D is a control. Choose a control before assessing the risk and you skip the step that tells you whether this control fits, whether it's enough, and whether a recruiter reviewing only rejections covers the harm you're worried about. Human oversight will probably end up in the design. It gets chosen as a result of the assessment.
B is the only option that works whichever laws apply and however their dates move. It's also the order ISACA's own task list implies: inventory and classify (task 13), then assess and confirm conformity (task 8), then choose controls (task 12).
Notice who's most likely to miss this question: the candidate who knows the EU timeline cold. The frameworks get you to four plausible answers. Choosing between them takes a sequencing habit, and that habit is learnable. It's the same logic behind how AAISM scenario questions are built, where the tempting wrong answer is usually a correct action placed at the wrong point in the process.
Where AAISM Stops
AAISM qualifies you to build and run the program that makes compliance possible. Deciding what a law means for your organization stays with legal counsel. If you're weighing it as an AI compliance certification, that's the line to keep in mind: it certifies security management judgment about AI, including judgment about regulatory requirements.
In practice, the work splits like this:
Question | Who owns it |
|---|---|
Does this law apply to this use case? | Legal counsel |
Is this AI use within our risk appetite? | Business leadership, advised by you |
What's in our AI inventory, and how is each system classified? | You |
Which assessment method do we use, and where's the evidence? | You |
Has a regulatory change triggered a reassessment? | You run the process; counsel confirms the legal reading |
Three of those five rows land with the AAISM holder, and that's where the career value sits. Right now, very few people in a typical organization can credibly say they know AI security management. When the board asks whether the company is ready for the EU AI Act, the person who can answer with an inventory, an assessment method, and a timeline tends to become the one who leads AI security from then on. Sometimes that comes with a new title. It almost always comes with more influence and more interesting work.
Certification in 1 Week
Study everything you need to know for the CISSP exam in a 1-week bootcamp!
Frequently Asked Questions
You don't need to memorize them for the exam. Several major deadlines moved in 2026 alone, including the EU's high-risk obligations, which shifted to December 2, 2027, and Colorado's AI law, which was repealed and replaced before it applied. Understand how each major regime is structured and how a regulatory change triggers reassessment, and check current dates at the source whenever your job needs them.
AAISM is an AI security management certification that treats regulatory compliance as a core responsibility: it validates that you can govern AI, assess its risk, and implement controls that satisfy regulatory requirements. Interpreting what a specific law requires of your organization remains a job for legal counsel.
AAISM covers the skills US state AI laws reward, without testing any one state's statute. Texas makes substantial compliance with a framework like the NIST AI RMF an affirmative defense, and Colorado's replacement law requires notices and human review for automated consequential decisions. An AI inventory, a repeatable assessment method, and documented oversight cover most of what those laws ask for.
Legal counsel interprets AI regulations and decides which ones apply to a given use case. The AAISM holder builds and runs the program that meets them: the AI inventory, risk classification, impact assessments, controls, and the evidence trail. The two roles meet at reassessment. The security manager spots a regulatory change, and counsel confirms what it means for the organization.
ISACA doesn't publish a separate share for regulation. It sits in Domain 1, which makes up 31% of the 90-question exam, alongside frameworks and stakeholder considerations. Regulatory requirements also appear in supporting tasks on impact assessments, incident reporting, and monitoring for change, so regulatory thinking shows up across more of the exam than that one domain.
The Laws Will Keep Changing. Be the Person Who Knows What Comes First.
The CV-screening question comes down to one move: working out what comes first when the rules are still shifting. Our free AAISM Exam Strategy guide walks through how AAISM scenario questions are built and how to eliminate the answers that are right but premature. It's a small sample of the exam strategy that runs through our full courses.
The AAISM Online Bootcamp is the fastest route to the exam: live classes on Zoom taught by Joseph Zefrani, a knowledge assessment after each day that shows which topics still need work, and the full MasterClass included for your review afterwards. The AAISM MasterClass is the self-paced route, taught by Rob Witcher and Joseph Zefrani, who both hold CISSP and AAISM. Its study plan fits around your schedule, its review guide moves your time toward your weaker topics, and it includes three practice tests with 270 questions, plus one-on-one mentoring in the Preferred and Premier tiers.
Whichever you choose, if your first attempt doesn't go your way, a mentor goes through your results with you and builds the plan for the next one.
John is a major force behind the Destination Certification CISSP program's success, with over 25 years of global cybersecurity experience. He simplifies complex topics, and he utilizes innovative teaching methods that contribute to the program's industry-high exam success rates. As a leading Information Security professional in Canada, John co-authored a bestselling CISSP exam preparation guide and helped develop official CISSP curriculum materials. You can reach out to John on LinkedIn.
