Remember the lawyer who stood before a federal judge with a brief built on cases ChatGPT had invented? In Mata v. Avianca (2023), six of the decisions the lawyer cited simply didn’t exist, and the court fined the lawyers and their firm $5,000. Since then, courts have issued AI disclosure orders, regulators on three continents have published AI guidance, and clients have started asking firms exactly how their data is being fed into AI tools.
If you’re a lawyer, you’ve likely felt both sides of this. You know AI can save you hours on research, drafting, and document review. You also know a single unverified citation can end up in a sanctions order with your name on it. If you want the benefits without becoming the next headline, the IAPP now has a credential built for exactly that: the Certified AI Specialist / Legal (AISL).
The AISL exam is set for launch in January 2027. While we don’t know all the specifics yet, some things are starting to emerge. A draft Body of Knowledge and Exam Blueprint is already out, and it shows a focus on how lawyers (and even judges) actually use AI, and what goes wrong when they do.
What's in the AISL Draft Body of Knowledge and Exam Blueprint
All IAPP exams are based on a document called the Body of Knowledge (BoK) and Exam Blueprint. This document details the concepts and topics you need to know for the certification exam.
The draft BoK for AISL certification organizes the exam into four domains. Here's what each one covers, and why it matters for your practice.
Domain I — Introduction to AI in the Legal Profession. How legal-specific tools like RAG-based research platforms differ from general-purpose chatbots, and the risks unique to legal work: the three kinds of hallucination (a fabricated case, a real case misapplied, and a key precedent quietly left out), what happens to privilege when client data enters an AI tool, and newer risks like shadow AI, "vibe coding" by lawyers, and agentic tools that cross into the unauthorized practice of law.
Why it matters: Effective supervision of AI requires a clear understanding of how it works and where it fails. That understanding is the foundation for every other competency in the blueprint.
Domain II — How AI Is Deployed in Legal Workflows. Where AI delivers value in practice: docket searches, contract redlining and due diligence, e-discovery triage and privilege logs, pleadings and deposition preparation, litigation outcome forecasting, and jury selection. It also covers the bench, including how judges use AI to verify lawyers’ citations, summarize trial transcripts, and draft judgments.
Why it matters: Each application carries a distinct risk profile. Understanding both the benefit and the exposure allows AI to be adopted deliberately, in the places where it strengthens the quality of legal work.
Domain III — Oversight and Monitoring. The most extensive and most practical domain. It covers acceptable use policies and AI inventories, vendor due diligence (Can the tool prevent prompt leakage? Does it create an audit trail?), human verification and random sampling of outputs, checkpoints for agentic AI, and cost management through prompt libraries, model tiering, and token-based pricing.
Why it matters: Oversight is what makes AI use defensible. When a client, court, or regulator asks how AI was used on a matter, documented controls provide the answer.
Domain IV — Ethical, Contractual, and Regulatory Requirements. The professional rules that apply when AI is in the loop, anchored in ABA Formal Opinion 512 and the duties of competence, candor, confidentiality, and supervision, along with AI guidance from bar regulators in the U.K., Australia, New Zealand, and Canada. It also addresses AI-generated evidence, the E.U. AI Act, and the billing and insurance questions AI raises.
Why it matters: AI does not create new professional duties; it changes how existing ones are met. This domain applies the obligations lawyers already carry to the tools they now use.
Who the AISL Is For: Every Attorney Using AI
For the first time, the weight of an IAPP credential is aimed squarely at the legal profession. If you're an attorney who uses AI to research, draft, review documents, or prepare for trial, the AISL was written for you. That includes litigators, transactional and corporate lawyers, in-house counsel, and solo and small-firm practitioners.
And it isn't only for lawyers. If you work alongside attorneys, as a paralegal, legal operations lead, legal engineer, knowledge manager, compliance officer, or member of a firm's risk and ethics team, the AISL gives you a clear framework for the legal side of AI. Why privilege matters, what a fabricated citation really costs, what lawyers are professionally obligated to do: concepts that may have felt like legal fine print start to make sense, and you become the colleague who can spot a problem before it reaches the court.
That’s what sets it apart from the Artificial Intelligence Governance Professional (AIGP) certification. The AIGP trains governance professionals to manage AI across an organization. The AISL trains lawyers to use AI in their own practice without breaching their duties to clients and courts.
What We Don't Know Yet
The IAPP hasn't yet announced a launch date, exam fee, or exam format, and the draft blueprint lists the question count for every domain as "TBD." It has stated, however, that the AISL certification is likely to go live in January 2027.
What we can tell you: when the AISL does go live, the team at Privacy Bootcamp that has already helped students obtain more than 6,000 IAPP certifications will be ready. And if you follow along and join our mailing list, you can be too. Be on the lookout from us as more information emerges in the coming months.
