Why UK regulators allow monitoring AI, but only with a human in the loop
24 August, 2026
UK universities have shown that monitoring AI can work. But UK regulators have set a firm condition for using it: AI can flag issues, and a human has to make the final call. That one rule shapes every compliant deployment.
In brief
- UK universities have strong, published research on monitoring AI (Strathclyde, UCL, University of Central Lancashire), yet no UK school runs AI exam invigilation or engagement tracking at scale.
- The ICO has enforced against school biometrics (North Ayrshire, Chelmer Valley), and Ofqual says AI as the sole invigilator is unlikely to comply.
- The workable pathway is AI-assisted and human-supervised, with a data-protection impact assessment and genuine alternatives built in from the start.
The University of Strathclyde has published peer-reviewed research on multimodal classroom engagement detection. Researchers at UCL developed video-analytics systems for collaborative learning assessment. The University of Central Lancashire created datasets for engagement labelling with full participant consent.
The academic foundation for AI in education is genuinely strong. Yet look at operational school deployments and the picture inverts. No UK school has been found using AI for exam invigilation or engagement tracking at scale. The deployments that did happen, facial recognition for lunch payments, attracted enforcement from the Information Commissioner's Office. The gap between research and deployment is not a capability problem. It is a regulatory one.
The ICO record: even simple systems failed
In September 2021, North Ayrshire Council introduced facial recognition in nine school canteens covering 2,569 pupils. The purpose was straightforward: staff would activate the camera, capture a student's face, match it to a template, and open the lunch account.
On 22 October 2021, the system was paused. The ICO found that the deployment lacked a lawful basis, failed to give transparent information to students and parents, did not conduct an adequate data-protection impact assessment, and breached necessity and proportionality standards.
In March 2023, Chelmer Valley High School in Essex introduced a similar system. The outcome was identical: ICO enforcement, the same findings.
The pattern is instructive. These were not surveillance projects. They were identity-verification systems for a legitimate, narrow purpose. Both still attracted enforcement, because the institutions did not build governance into the initial design.
For anyone considering remote exam monitoring in the UK, the enforcement record is a clear warning. Regulators are actively scrutinizing biometric systems in schools. If your legal basis is unclear, your transparency vague, or your justification weak, you will be reviewed.
Ofqual's position: AI-assisted, not autonomous
In December 2025, Ofqual, the UK qualifications regulator, published a consultation on on-screen assessment. The key finding was direct: "AI used as the sole form of remote invigilation is unlikely to comply with current regulations. Human involvement currently provides the best assurance of authenticity and malpractice prevention."
This is not a ban on monitoring. It is a requirement for human oversight. The regulatory pathway is not "AI monitors autonomously." It is "AI flags potential issues, humans review and decide."
In May 2025, the Assessment and Qualifications Alliance (AQA, the UK's largest exam board) publicly discussed AI-supported invigilation as a future direction. The framing was explicit: AI would "reduce pressure on human invigilators," not replace them.
Institutions planning remote proctoring in the UK need to adopt this framing from the start. Systems that present themselves as "autonomous AI proctoring" will not clear review. Systems designed around "AI-assisted, human-supervised verification" will.
The research behind this article
This piece summarizes our full market-research paper, Camera-Based AI in UK Classrooms: The State of Evidence, including sources and methodology.
Three design requirements that clear UK review
Human review embedded in the workflow. When an automated system flags a session, a human must review the evidence and make the final integrity decision. That decision should be documented and defensible. Auditors will look for genuine human involvement, not a rubber stamp.
A data-protection impact assessment before pilot launch. Both ICO enforcement actions involved institutions that skipped an adequate assessment. A proper one documents what data is collected, why it is necessary, what risks it creates, who has access, how long data is kept, what alternatives exist, and what safeguards prevent misuse. It should address failure scenarios too. What if false-positive rates are high? What if video data is breached?
Accessible alternatives built into the design. If a student can sit an exam in a certified testing center instead of on camera, that option must be genuinely available. If someone cannot use remote proctoring because of accessibility barriers or connectivity, an equivalent option must exist. Regulators expect this in the initial design, not bolted on later.
From research to deployment
UK universities have real capability in engagement and monitoring research. Strathclyde, UCL, and others have published serious work. For exam boards and schools, the question is no longer "Can this technology work?" The research says yes. The question is "Can we deploy it in a way that satisfies the ICO, complies with Ofqual, and serves students equitably?"
The institutions that have deployed monitoring successfully at UK universities did not skip the governance layer. They anticipated review, built human oversight into the workflow, designed for data protection from the start, and made sure alternatives existed for students who declined biometric monitoring.
Building proctoring that holds up under review
Constructor Proctor is built for the UK regulatory pathway. It embeds human review in the verification workflow: AI surfaces flags, and institutional staff make the exam-integrity decisions. It offers configurable recording policies aligned to the different jurisdictions across England, Scotland, Wales, and Northern Ireland. And it keeps audit trails documenting every verification decision and every instance of human oversight, so if an ICO review arrives, the documentation is already in order.
The research is proven. The regulatory pathway is narrow but clear: AI-assisted, human-supervised, with alternatives available and full transparency and data governance built in.
Discover Constructor Proctor
See how Constructor Proctor keeps a human in the loop and the audit trail an ICO review expects.
