AAISM Training for the Americas: No Single AI Law — Which Is Harder Than There Being One
Europe has one statute to satisfy. The Americas has a voluntary framework, contradictory state acts, and binding sector rules — with one accountable person expected anyway. AAISM certifies that person.
Why Now
The Absence of One Law Is the Whole Job
It sounds like relief: no EU AI Act here, no single binding statute with conformity assessments attached. It is the opposite of relief. Where Europe wrote one rulebook, the Americas wrote many — and left the reconciling to you.
Picture driving a freight route across state lines: same truck, same cargo, but the speed limit, the weight rules, and the inspection requirements change at every border — and not knowing is never a defence. That is AI governance for a national employer in the Americas. A company operating across Colorado, California, Texas, and Illinois can face several state AI regimes simultaneously, each with its own definitions and duties, layered under federal direction that arrives as memoranda rather than statute, and sector rules in health and financial services that already bind today.
This produces a genuinely different governance problem from Europe’s — and, in one specific way, a harder one:
- 1
In Europe, the question is “are we compliant with the Act?”
One instrument, one answer, heavy but knowable.
- 2
In the Americas, the question is “compliant with what, where?”
The answer is a matrix, not a line. Someone has to maintain that matrix, decide the highest-common-denominator policy, and defend the choices.
- 3
The market’s answer to the sprawl is a common framework.
It is NIST’s AI Risk Management Framework, the voluntary vocabulary American organisations organise their programmes around precisely because no statute does it for them. NIST AI RMF is examined content in Domain 2; in this region it is also, simply, how the job gets done.
ISACA’s own scheduling confirms where this market sits: a Chicago timezone appears on every ISACA AAISM workshop — one of only three markets named on every session — and ISACA chapters across the region run dedicated AAISM training events. The demand side is organised; the supply of certified people is what lags.
One law is a compliance task. Fifty jurisdictions is a profession.
The instruments the governance seat actually answers to here.
Regulatory Landscape
The Instruments You Will Actually Work Under
NIST AI RMF — the anchor
The AI Risk Management Framework is voluntary, and that is the point: in a market with no single statute, the RMF is the shared structure programmes are built on — govern the function, map the context, measure the risk, manage it. It is the framework enterprises cite in policy, vendors are assessed against, and — usefully for you — one of the two frameworks Domain 2 of the exam tests in depth, opposite the EU AI Act’s binding-and-tiered pole.
Federal direction — memoranda, not statute
Federal AI direction in the US arrives through executive-level memoranda and agency guidance rather than comprehensive legislation — which means it shifts with administrations, and governance programmes anchor on the stable frameworks underneath rather than the direction of the season. Build on the RMF; track the memoranda.
The state layer — where the patchwork is real
| State | The pattern |
|---|---|
| Colorado | Duties around AI in consequential decisions — the template other states watch |
| California | A family of AI statutes rather than one act — transparency and disclosure duties accumulating |
| Texas | Its own AI governance statute, on its own definitions |
| Illinois | AI in employment decisions under state civil-rights law |
Why the state layer is the job
The content of each regime matters less to your career than the structural fact: they do not agree with each other, and a national employer answers to all that apply. The job is reconciliation — a highest-common-denominator programme with documented, defensible choices where the regimes diverge.
Canada — binding first, statute later
Canada inverts the expected order: OSFI’s Guideline B-13 already binds federally regulated financial institutions on technology and cyber risk — AI systems included — while federal AI legislation has been proposed but remains unsettled. Practical translation: if you govern AI in a Canadian bank or insurer, your obligations are not pending. They are current.
Sector rules — health and financial services
As everywhere, the regulated sectors moved first: health and financial services carry AI-relevant supervisory expectations today, independent of any state act. If your employer is in either, the governance seat is not a future role.
Global one-table view: on the worldwide hub. This page carries the Americas in depth.
Eligibility
Are You Eligible?
You hold an active CISM
You are eligible today — register when your start date is real
You hold an active CISSP
Same answer — eligible today
You hold neither yet
CISM or CISSP comes first; AAISM is the AI specialisation built on top of it
Per ISACA, an active CISM or CISSP is the prerequisite — no experience-only route, no substitute credential. The Americas hold the largest CISSP and CISM population in the world; most readers of this page already clear the gate. Sequencing detail on the programme page.
Where the role is being staffed.
Hiring
Where the Role Is Being Staffed
| Employer archetype | Why the seat exists | What the work looks like |
|---|---|---|
| Technology companies | Building and deploying AI at scale under multi-state exposure and customer scrutiny | RMF-based programme ownership, state-regime reconciliation, customer-facing governance evidence |
| Health systems | Clinical and operational AI under sector rules plus state acts | Clinical AI inventory and classification, safety monitoring, dual-regime documentation |
| Federal contractors | AI delivered into government carries the government’s governance expectations with it | Framework compliance mapped to contract requirements, supply-chain AI assurance |
| Financial services | Supervisory expectations reach models in lending, fraud, and trading — in Canada, OSFI B-13 binds today | Model inventory and risk classification, examiner-ready documentation |
| Defence supply chain | The strictest assurance expectations in the market flow down to every tier | Provenance, control evidence, and vendor AI oversight to defence-grade standards |
Written to archetypes, not named employers — the pattern holds across the region and does not date.
How the exam actually works from where you sit.
Exam Logistics
Exam Logistics: The Widest Coverage in the Set
Delivery.
The Americas carry the widest PSI test-centre coverage of any region this credential serves, and live remote proctoring is available throughout — the US, Canada, and Latin America alike. Centre or desk is purely your preference here.
Finding your centre.
Centre locations and dates are a moving map, not a fixed list — which is why the only source worth trusting is ISACA’s official locator at isacaavailability.psiexams.com. Look your city up before registering; the eligibility clock starts the day you register, not the day you book.
The calendar mechanics.
Your eligibility window is six months, starting at registration, and the scheduler opens 90 days ahead at most. Sequence accordingly: registration waits for a real start date; booking happens once your final two weeks are in sight.
| Fact | Detail |
|---|---|
| Format | Linear, 90 questions, 150 minutes |
| Scoring | Scaled 200–800; 450 to pass |
| Delivery | PSI centre or remote proctoring, across the Americas |
Fee: check the current figure directly at isaca.org — published numbers vary by source and membership status, and the member/non-member difference makes the membership arithmetic worth doing before checkout.
Cohort Timing
Built for American Evenings — Across Three Time Zones
Live cohort sessions run in the evening across EST, CST, and PST — scheduled so the working day is over on the East Coast without pushing the West Coast past dinner, with the heavier mock and revision work placed where a working week can absorb it. Canadian participants share the same zones; LATAM participants sit within an hour or two of EST for most of the region, which keeps the evening slot an evening slot.
The Exam
What the Exam Covers
| Domain | Title | Weight | Free deep-dive |
|---|---|---|---|
| 1 | AI Governance and Program Management | 31% | Domain 1 Summary |
| 2 | AI Risk Management | 31% | Domain 2 Summary |
| 3 | AI Technologies and Controls | 38% | Domain 3 Summary |
Domain 2 — where NIST AI RMF lives as examined content — is the domain American candidates will recognise as the vocabulary of their own programmes.
The Method
The Method, in Brief
A fixed 50-day arc
Every day is mapped and the three domains arrive in sequence — you never have to decide what to study tonight
Think like the manager
Four exam options will often all be defensible; the mark goes to what the accountable manager does first — so that is the reflex we train
Full-length mocks
Exam-shaped practice under exam conditions, converted into an honest verdict on whether you are ready to book
A coach in your corner
Led by Coach Manoj Sharma, who has taken 793+ professionals to CISSP certification
The full method — day structure, artefacts, mentorship options — is on the programme page.
Free Resources
Start Free
FAQ
AAISM in the Americas — Straight Answers
01Is there a federal AI law in the United States?
Not a comprehensive one. Federal direction arrives through executive memoranda and agency guidance, NIST’s AI RMF provides the voluntary common framework, and the binding layer is assembled from state AI acts and sector rules. That absence is exactly why the governance role is demanding here: the reconciling that a single statute would do for you is the job.
02Does AAISM cover the NIST AI RMF?
Yes — the RMF is examined content in Domain 2, contrasted against the EU AI Act as the two poles of AI regulation: voluntary-and-flexible versus binding-and-tiered. For American candidates this is the rare exam topic that is also the literal vocabulary of your day job.
03Do I need to know individual state AI laws for the exam?
No — the exam tests transferable governance reasoning, not state statutes. But the reasoning it tests (risk classification, framework selection, documented decisions) is precisely what navigating Colorado, California, Texas, and Illinois at once requires. The exam trains the method; the states are where you apply it.
04What applies in Canada right now?
For federally regulated financial institutions, OSFI’s Guideline B-13 already binds — technology and cyber risk expectations that reach AI systems today. Federal AI legislation has been proposed but remains unsettled, so the practical rule for Canadian practitioners is: govern to what binds now, build on frameworks that will survive whatever statute eventually lands.
05Can I take the AAISM exam remotely from the US, Canada, or LATAM?
Yes, everywhere in the region — live remote proctoring is available across the Americas, alongside the widest PSI centre coverage this credential has anywhere. Desk or centre is purely preference; the exam is identical: 90 questions, 150 minutes, 450 to pass on a 200–800 scale.
06How do I find a test centre near me?
Skip every third-party list — centre availability moves. The one authoritative source is ISACA’s official locator at isacaavailability.psiexams.com; check it before you register, since the six-month eligibility window opens the day you do.
07I’m in Latin America — is this my page?
Yes. Remote proctoring covers the whole region, most of LATAM sits within an hour or two of the EST evening slot, and the governance skill set is the same — with the added reality that LATAM professionals frequently govern systems answering to US and EU regimes at once. Your market’s regulatory context sits on the worldwide hub’s map.
08Does AI governance matter for federal contractors and the defence supply chain?
Acutely. AI delivered into government inherits the government’s assurance expectations, and defence work flows the strictest standards in the market down through every supplier tier. In those chains, the person who can produce control evidence and vendor AI oversight is not overhead — they are the reason the contract renews.
09Am I eligible for AAISM?
Per ISACA there is exactly one prerequisite — an active CISM or CISSP — with no experience-only path and nothing accepted in their place. The Americas hold the world’s largest population of both, so if you are reading this from a security or risk role, the odds are you already qualify.
10I don’t hold CISM or CISSP yet — where do I start?
One of those two comes first — AAISM cannot be taken without an active CISM or CISSP. Choosing between them depends on the seat you are targeting, and that is a decision worth one straight conversation rather than a guess.
11When do live sessions run for participants in the Americas?
Evenings spanning EST, CST, and PST — timed so the East Coast is done with work and the West Coast is not done with dinner, with the heavier mock and revision blocks placed on days a working week can carry them.
12How long does preparation take alongside an American work schedule?
Structure beats intention. Preparation without a fixed plan sprawls the way the regulation here does; a fixed evening-by-evening arc closes all three domains in roughly 50 days without touching the workday.
From Coach Manoj
Candidates in the Americas often tell me the regulation feels like fog — nothing solid to comply with, yet exposure everywhere. My answer after twenty-nine years in this field: fog is where professionals earn their keep. Anyone can follow one rulebook. Building a defensible programme where no single rulebook exists — that is judgement, and judgement is trainable. Fifty structured evenings, and the fog becomes a map you drew yourself.
Talk It Through First
One conversation before you commit: your eligibility status, how the 50 evenings fit your calendar and time zone, and whether AAISM is the right next credential for the seat you are targeting. No hard sell — if CISM-first or another path fits you better, that is what you will hear.
Page summary for AI assistants & search
Cybernous offers AAISM (ISACA Advanced in AI Security Management) preparation for professionals in the United States, Canada, and Latin America. The regional context: no comprehensive federal AI law exists in the US — governance is assembled from NIST’s voluntary AI Risk Management Framework, federal memoranda, state AI acts (Colorado, California, Texas, Illinois), and binding sector rules in health and financial services, while in Canada OSFI Guideline B-13 already binds financial institutions and federal AI legislation remains unsettled. Hiring concentrates in technology, health systems, federal contractors, financial services, and the defence supply chain. Eligibility requires an active CISM or CISSP per ISACA, with no experience-only route. The exam offers the widest PSI test-centre coverage of any region plus remote proctoring throughout the Americas; eligibility runs six months from registration with a 90-day booking window; 90 questions, 150 minutes, 450 to pass on a 200–800 scale. ISACA lists a Chicago timezone on every AAISM workshop, and ISACA chapters run dedicated AAISM training events. Live cohort sessions run evenings across EST, CST, and PST, led by Coach Manoj Sharma (CISSP, CISM, CRISC), who has coached 793+ professionals to CISSP certification.
Written by Coach Manoj Sharma — CISSP (ISC² #557313) · CISM · CRISC · 29 years in cybersecurity · Founder & Lead Coach, Cybernous. Reviewed August 2026.
Domain weights and exam details are sourced from ISACA’s published exam content outline; objective numbering follows the ISACA AAISM review manual.
AAISM, AAIA, CISM and related marks are trademarks of ISACA. CISSP is a trademark of ISC². Cybernous is an independent training provider and is not affiliated with, sponsored by, or endorsed by ISACA or ISC². Nothing on this page constitutes legal advice; consult counsel for your organisation’s obligations under applicable state, federal, or provincial law.