EXIN AISP Exam Blueprint: Domains, Weights and Format
Check the five EXIN AI Security Professional domains, official weights, exam format and the coverage of the free AISP practice exam.
Official format
The EXIN AISP.EN preparation guide, edition 202608, specifies 40 multiple-choice questions in 90 minutes, closed book, with 26 correct answers required to pass. That is an average of 2 minutes 15 seconds per question; use shorter items to leave time for evidence-heavy scenarios.
| Official domain | Weight | Free practice questions |
|---|---|---|
| AI security in the organization | 15% | 6 |
| AI security threats | 37.5% | 15 |
| AI security controls | 27.5% | 11 |
| AI security testing | 7.5% | 3 |
| Privacy and compliance in AI security | 12.5% | 5 |
The free practice exam follows these proportions exactly. Its mix of scenarios, code, configuration and evidence tables is an editorial practice choice, not a claim about the exact exhibits you will encounter on exam day.
What the domains require
Organization: Apply GUARD activities, assign responsibilities and understand threats to the data, models, integrations and people involved. Threat modeling includes agentic systems and actions performed through tools.
Threats: Distinguish input, development-time and runtime threats. Trace the attacker’s access, the affected asset and the mechanism: a misleading retrieved fact, a malicious instruction and poisoned training data are different cases.
Controls: Select governance measures, limit sensitive data and constrain unwanted behavior. Judge a control against the particular exposure and operational requirements rather than treating encryption, a signature or human review as a complete solution.
Testing: Define authorized scope, choose tests for the relevant threat and verify remediation. Keep evidence of a successful bounded test separate from broader claims about system security.
Privacy and compliance: Recognize privacy risks across data collection, inference, retrieval and monitoring. Understand the roles of the specified standards and the principles behind GDPR, AI Act and copyright considerations.
Which source controls the outline?
The formal preparation guide groups organization and threat modeling together, giving five weighted exam domains and twelve subdomains. EXIN’s marketing site separates those areas into six learning headings. Use the formal guide for the exam weighting.
The guide maps required reading to the April 21, 2026 OWASP AI Exchange edition supplied by EXIN. The live Exchange can change; check the edition linked by EXIN before revising terminology. The guide also names ISO/IEC 23894, 27005, 42001 and 5338 as reference material. Understanding their purpose does not mean memorizing every clause of those standards.
Use official resources to confirm current guidance. Practice scores describe your performance on these original questions; they do not predict an official exam result.