Online exam security is no longer measured solely by whether it catches attempts to cheat. An institution must also be able to explain what signals it collects, what the AI recommends, who makes the final decision, and how candidates can understand the process. In 2026, the European Union Artificial Intelligence Act (AI Act) has made these questions more visible, particularly for education and assessment processes.

When might online proctoring fall within the high-risk category?

The AI Act does not treat all AI tools in the same way; it takes a risk-based approach. Article 6 and Annex III of the current text of the Regulation identify certain systems used in education and vocational training as high-risk use cases. Examples include systems that determine access to or admission to an educational institution, tools that assess learning outcomes, systems that assess a person’s level of education, and systems that monitor or detect prohibited conduct during a test.

This does not mean that “every video recording is automatically high risk.” The intended use, the actual impact on decisions, and how the system profiles an individual are the determining factors. For example, if a tool only generates a ranking of anomalies for a human proctor and does not affect the final decision, the exception conditions under Article 6 may also be considered. However, the provider must document this assessment before placing the system on the market or putting it into service; profiling individuals is excluded from the exception. Institutions should explicitly request clarification of this distinction in procurement documents.

Four areas of control institutions should examine in 2026

1. Put the purpose and decision flow in writing

“Preventing cheating” alone is not a sufficient system purpose. Define the role of each function in the exam process, such as identity verification, room analysis, second-device signals, tab switching, and audio and video recording. Does the AI only flag risky moments, or does it invalidate the candidate’s exam? The answer to this question is the basis of the risk assessment.

2. Turn human oversight into a procedure

Article 14 of the AI Act requires high-risk systems to be designed to allow human oversight during use. Human oversight is not simply a matter of having an “approve” button on the screen. An authorized person must be able to monitor the output, understand why a signal was generated, override an incorrect flag, and initiate additional review when necessary. Exam instructions should therefore specify the review threshold, a second reviewer, the appeal channel, and how decision records will be maintained.

3. Manage records as traceability infrastructure, not as evidence

Video, audio, screen, and desktop recordings are important not only to support the post-exam report, but also to show how a decision was reached. The records plan should include the retention period, access roles, deletion procedures, encryption, and an event log. QProctor’s reporting capabilities, such as risk scores, anomaly lists, and video clips, can make this process visible; however, the institution’s own policies should determine which data is processed for what purpose and how long it is retained.

4. Give candidates clear and proportionate information

Explaining to a candidate why the camera, microphone, identity verification, or browser lockdown is used strengthens trust. The information notice should clearly explain which checks are automated and which are performed by a human, that a possible flag does not directly mean failure, and how to appeal. As the AI Act’s transparency provisions become relevant in the period around August 2, 2026, data protection and local regulatory obligations must also be assessed separately.

Practical preparation checklist

Before putting an exam into operation, sign off on the following short checklist together with the product, legal, information security, and assessment teams:

• Are the system’s purpose, user role, educational context, and impact on decisions documented?
• Has the Article 6 AI Act classification—and, where applicable, the rationale for assessing the system as not high risk—been documented?
• Can the authorized person reviewing the risk score interpret and correct the output?
• Are access, retention, and deletion rules defined for video, audio, screen recordings, and event logs?
• Are candidate information, the appeal process, and the technical support channel visible before the exam?
• If you are a public authority or a private entity providing public services, has the need for a fundamental rights impact assessment under Article 27 of the AI Act been reviewed?

A fundamental rights impact assessment under Article 27 may be relevant for public-law entities and certain private entities providing public services that put certain high-risk systems into operation for the first time. The European Commission explicitly states that this assessment complements an existing data protection impact assessment and does not replace it. This distinction is important for protecting both candidate rights and institutional auditability in online exams.

How can you strengthen a secure exam process with QProctor?

QProctor’s approach brings AI-supported proctoring together with the live proctoring option, identity verification, 360-degree environment analysis, device and behavior monitoring, detailed reporting, and Q Browser lockdown features. This setup can help an institution move from “I only saw suspicious activity” to “I reviewed the signal, justified the decision, and was able to explain it to the candidate.”

The key distinction here is this: a proctoring platform supports the technical part of the compliance process; it does not remove the institution’s responsibility for its purpose of use, decision-making authority, candidate information, or data retention. Therefore, when selecting a system, consider not only detection rates, but also human review, report comprehensibility, integrations, and the institution’s internal audit trail.

Frequently asked questions

Is every online proctoring system automatically high risk under the AI Act?

No. Classification is based on the intended use and the impact on decisions. Uses in education such as exam assessment or monitoring prohibited conduct during a test may fall under Annex III. If an exception is being considered, the rationale must be documented.

What does August 2, 2026 mean for institutions running online proctored exams?

The AI Act generally became applicable on this date. According to the Commission’s current FAQ, the rules for high-risk AI systems will apply on December 2, 2027. Institutions need to prepare in 2026 for transparency provisions and existing data protection obligations.

Can an AI risk score determine a student’s exam result on its own?

A risk score should be treated as a signal for review. Human oversight should make it possible to monitor and interpret the output and override it when necessary. The institution must clearly define the final decision and appeal process.

Sources

This article is based on official EU sources accessed as of October 14, 2026. It does not constitute legal advice; obtain an expert assessment for your institution’s use case.

1. European Commission — AI Act: Regulatory framework for artificial intelligence
2. European Commission — Navigating the AI Act (implementation timeline and Digital Omnibus explanation)
3. EUR-Lex — Regulation (EU) 2024/1689, current text as of July 27, 2026 (Article 6 and Annex III)
4. AI Act Service Desk — Article 14: Human oversight
5. AI Act Service Desk — Article 27: Fundamental rights impact assessment