Annex III point 3 lists AI systems intended to be used for monitoring and detecting prohibited behaviour of students during tests as a high-risk use case, subject to the Article 6 conditions and the profiling limit. A proctoring system must therefore be classified under Article 6, screened under Article 5 for biometric identification, categorisation and emotion inference, and assessed for transparency and data protection duties, before it is used in an examination. A flag raised by a proctoring system is an output requiring human review, not a finding of misconduct on its own. This guide does not decide any specific proctoring system and does not give examination or safeguarding advice.
Which proctoring functions are listed?
Annex III point 3(d) lists AI systems intended to be used for monitoring and detecting prohibited behaviour of students during tests. That listing covers systems that observe a student during an examination, by video, audio, screen or interaction data, and that detect behaviour said to indicate cheating or other prohibited conduct. A system that only records an examination, only checks identity before the test, or only provides a lockdown browser without behaviour detection, is assessed differently, and the distinction must be recorded from the actual function. The record should describe what is monitored, what behaviour is detected, what output is produced, who reviews the output and what consequence follows. A system that monitors behaviour continuously, that analyses gaze, movement or sound, and that generates a suspicion score or a flag, is within the listing's language, and its classification should be addressed directly rather than assumed from the vendor's description as a recording tool.
What must be screened under Article 5?
Proctoring systems must be screened under Article 5 before classification, because they commonly use biometric data and can infer emotions or categories. A system that identifies a student by face or voice must be screened for biometric identification, a system that categorises a student by biometric data must be screened for biometric categorisation, and a system that infers a student's emotions from facial expressions or voice in an education setting can engage the Article 5 prohibition on emotion inference, except for medical or safety reasons. The screen should examine each data source and inference separately, since a system can be lawful in its recording function and prohibited in its inference function. Where a function is prohibited, it must be removed or redesigned, and the remaining functions reassessed, before the system is used. The screen should be recorded with the reasoning for each prohibition, and qualified advice should be sought where a function is close to a prohibition.
For the broader regulatory framework, see healthcare and biometrics under the AI Act.
How should a flag be reviewed?
A flag raised by a proctoring system is an output that requires human review by a competent person with the time, information and authority to assess it. The reviewer should consider the flag in the context of the whole examination, the student's circumstances, the system's limitations and any alternative explanation for the behaviour detected, and should decide whether the behaviour was prohibited, whether further inquiry is needed, or whether the flag should be disregarded. The student should be given an opportunity to explain, and the decision should be recorded with the evidence considered, the reviewer and the outcome. An automatic consequence, such as a failed examination or a misconduct finding, imposed on the basis of a flag alone, without human review and without an opportunity to respond, does not reflect the oversight the Act requires for high-risk systems and risks an unfair outcome. The review process should be designed, documented and tested before the first examination, not improvised after the first flag.
What information must learners receive?
Learners must be informed, in clear and age-appropriate terms, that a proctoring system will be used, what it monitors, what data it collects, how long data are kept, who reviews flags, what consequences can follow and how a decision can be challenged. That information should be given well before the examination, so a learner can ask questions, seek an alternative arrangement where one is available, and prepare for the conditions of the test. Data protection law requires information about the processing, its purposes and the learner's rights, and education and examination rules can require additional information and safeguards, including for learners with disabilities or in vulnerable circumstances. The deployer should record what information was given, when and in what form, and should provide a contact route for questions and concerns. A learner who first learns of monitoring when the examination begins has not been given the information the law requires, and the examination's fairness can be called into question.
What evidence should a proctoring deployment keep?
The deployment file should record the system and version, the functions used, the Article 5 screen, the Article 6 classification, the data protection assessment, the oversight and review design, the information given to learners, the monitoring of flags and outcomes, and the appeals and their results. Monitoring should include the rate of flags, the proportion upheld or disregarded on review, whether flags fall unevenly on particular groups of learners, and whether the system's performance in the deployment environment matches its evaluation evidence. Where monitoring shows a pattern of false flags, uneven impact or reviewer overload, the deployer should escalate it to the provider, reassess the deployment and record the action taken. Recordings and biometric data should be kept only for the period lawful and necessary, with access controls and a deletion plan, since examination data are sensitive and their retention beyond necessity creates a data protection risk. A file that contains only the vendor's accuracy claims does not support a decision that affects a learner's result.
Continue with education admissions and assessment.
What does this guide not decide?
This guide does not decide whether any proctoring system is high-risk or prohibited, does not determine whether a learner committed misconduct, and does not give examination, safeguarding or data protection advice. Those questions depend on the system's functions, the examination rules, the learner's circumstances and the applicable law, applied to the specific facts with qualified advice. The guide also does not assess the accuracy or fairness of any proctoring tool. Where a proctoring system is to be used in examinations, confirm the classification, prohibition, transparency, safeguarding and data protection position with a competent authority or legal adviser before the system is used, and keep the assessment with the examination record.
Frequently asked questions
Is exam proctoring automatically high-risk?
Systems intended to monitor and detect prohibited behaviour during tests are listed in Annex III point 3(d) and are candidates for high-risk classification under Article 6, subject to the Article 6 conditions and the profiling limit. The function must be tested, not assumed from the label.
Can a proctoring flag alone fail a student?
No. A flag is an output requiring human review, an opportunity for the learner to explain, and a recorded decision. An automatic consequence imposed on a flag alone does not reflect the oversight required for high-risk systems.
Must learners be told in advance about proctoring?
Yes. Learners should be informed well before the examination, in clear and age-appropriate terms, about what is monitored, what data are collected, who reviews flags and how decisions can be challenged.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗