EXIN AI Security Professional study guide
EXIN AI Security Professional · Work through your exam, one topic at a time.
The EXIN AI Security Professional (AISP) is a new, independently examined certification from EXIN, a certification body with over 40 years of experience. AISP is built on the OWASP AI Exchange and is aligned with EU AI Act Article 15 and Article 4, the EU AI Act security standard (prEN 18282), and reflected in ISO/IEC 27090. It is also mapped to the European CEN standard for AI professional role profiles. The exam covers both technical security and governance in one credential, making it suitable for a wide range of roles and departments. Topics on this exam: AI security (technical security and governance) and AI governance and EU AI Act alignment. The EXIN AI Security Professional study guide has 2 sections and about 1,028 words.
01AI Security: Technical Security and Governance
This domain tests how you secure AI systems across the lifecycle and how technical controls connect to governance. Expect questions on threat taxonomies, adversarial machine learning, LLM-specific risks, supply-chain security, assurance, and the management-system controls that make security repeatable. Use a current taxonomy. The OWASP Top 10 for LLM Applications 2025 covers LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, and LLM10 Unbounded Consumption.
457 words, about 2 min02AI Governance and EU AI Act Alignment
This domain tests the EU AI Act's risk-based obligations and how to operationalise them through AI governance. Questions often turn on actor roles, system classification, timelines, evidence, and alignment with frameworks such as ISO/IEC 42001 and the NIST AI RMF. The Regulation is Regulation (EU) 2024/1689. Prohibited practices under Article 5 apply from 2 February 2025: social scoring, manipulative or exploitative techniques, untargeted facial scraping, certain biometric categorisation, emotion recognition in workplaces and education, and real-time remote biometric identification in public for law enforcement with narrow exceptions.
571 words, about 3 min