AI proctoring compliance in U.S. higher education starts with FERPA. State laws add another layer, such as Colorado’s SB 26-189, which may apply from January 1, 2027. If you have students or programs in the EU, the EU AI Act adds obligations from December 2, 2027. Six decisions help you prepare.
Public trust in higher education is under pressure. In a Lumina Foundation-Gallup survey from June 2026, only 38% of U.S. adults said they have a great deal or quite a lot of confidence in higher education. And 46% expect AI to make college degrees less important over the next five years.
Exam integrity is part of what makes a degree worth trusting. At the same time, the rules around the tools that protect it are changing.
We’ve mapped those changes in “The 2027 proctoring governance map,” a free infographic with six decisions for the provost’s office, IT, the registrar and general counsel. This article explains the reasoning behind each one. You can download the infographic further down this page.
Which rules reach your institution?
Start with two questions: which features of your proctoring solution use AI, and which AI rules apply to you. Your general counsel should help answer the second one.
Colorado. SB 26-189 amends Colorado’s AI law and takes effect on January 1, 2027. It may apply to automated decision-making technology that materially influences consequential decisions in education. It also includes specific accommodations for institutions covered by FERPA.
The EU AI Act. If you have students or programs in the EU, the Act may apply even though you are based in the U.S. (Article 2). Annex III, point 3(d), lists this use as high-risk:
“AI systems intended to be used for monitoring and detecting prohibited behaviour of students during tests in the context of or within educational and vocational training institutions at any level.”
The Annex describes uses, not products. Review what each feature does and ask your vendor for its classification in writing. These obligations apply from December 2, 2027, after Regulation (EU) 2026/1744 postponed the original August 2026 date.
One EU rule already applies. Since February 2025, Article 5(1)(f) bans inferring people’s emotions in educational institutions, except for medical or safety reasons. Ask your vendor, in writing, whether any feature does so.
How do FERPA and state privacy laws apply to a proctoring vendor?
Under FERPA, a vendor can receive education records without student consent only as a school official (34 CFR Part 99). It must perform a function you would otherwise assign to your own staff. It must stay under your direct control over how the records are used and maintained. And it must respect the limits on redisclosure.
State laws add another layer. The California Consumer Privacy Act, as amended by the CPRA, generally does not apply to public or nonprofit universities, but it can still reach their vendors (CPPA). State biometric privacy laws, such as Illinois’ BIPA, have also been invoked against proctoring tools.
Case in point: Powell v. DePaul University (2022). A federal court in Illinois dismissed a BIPA class action over online proctoring against DePaul University. It held that the university qualified as a financial institution exempt from the state law.
| Rule | When it may apply | What to ask |
| FERPA | Institutions covered by FERPA | How the vendor acts as a school official under your direct control |
| Colorado SB 26-189 | From January 1, 2027, to automated technology that materially influences consequential decisions in education | Whether any feature falls within its scope (general counsel) |
| CCPA, as amended by the CPRA | Generally not public or nonprofit universities; it can reach vendors | Whether it applies to the vendor’s handling of California residents’ data |
| State biometric privacy laws, such as BIPA | Depends on the state and its exemptions | How the law applies to the features you plan to use (general counsel) |
| EU AI Act and GDPR | Only with students or programs in the EU | The vendor’s written classification of AI features and where data is hosted |
Before signing, ask the vendor for a table showing which rule applies to each module of the service and where the data is stored.
Why does LMS integration matter?
A poorly planned integration causes problems on exam day: misconfigured permissions, or evidence that doesn’t reach instructors on time. Before you decide, check how the solution connects to your LMS (plugin, LTI standard or API) and what data the two systems exchange.
SMOWL integrates with Moodle, Canvas, D2L (Brightspace), and Blackboard, among other LMSs. Learn more in our FAQs.
Start with a pilot in a few courses. It helps you catch setup issues and agree on who handles each type of problem during exam periods.
What data is collected, and for how long?
Your privacy policy should state what data the system collects, who can access it and how long it’s kept. Limit access to recordings to authorized staff and log every access.
Under FERPA, you must respond to requests to inspect education records within 45 days, and you can’t destroy records while a request is pending. Align your deletion schedules with that right.
If you are a public institution, review room scans with particular care.
Case in point: Ogletree v. Cleveland State University (2022). A federal court in Ohio ruled that a public university’s room scan before an online exam violated one student’s Fourth Amendment rights, in that student’s circumstances.
If you have EU students or programs, review the legal basis and the data protection impact assessment with counsel before launch.
SMOWL complies with the GDPR. The institution is the data controller and Smowltech is the data processor. Data is hosted in the European Union, with no transfers outside the EU. Each institution sets its retention periods and Smowltech applies them.
How should you prepare faculty and students?
Faculty: keep a human in the loop
An incident flagged by the system is a signal that someone has to interpret. Define who reviews incidents, using what criteria and within what time frame. Make sure no academic misconduct finding rests only on an automated flag, and train reviewers on the limits of the system, including false positives.
In Colorado, SB 26-189 may also give students the right to request meaningful human review of an adverse outcome. If the EU AI Act applies, Article 26 requires assigning human oversight to people with the necessary competence and authority.
Students: knowing what to expect
Before the exam, students should know what is monitored, with what data and who to contact with questions. From January 1, 2027, Colorado’s SB 26-189 may require clear notice before automated technology materially influences a consequential decision. Where the EU AI Act applies, Article 26 also requires informing people that they are subject to a high-risk AI system.
Publish a short guide in advance and offer a low-stakes practice exam with the same settings as the real one. Plan alternatives for students who need accessibility accommodations or lack the necessary equipment.
Frequently asked questions
Is all AI proctoring high-risk under the EU AI Act?
Not automatically. Annex III describes uses, not products: it lists AI systems intended for monitoring and detecting prohibited behavior of students during tests. The Act matters to U.S. institutions only if they have students or programs in the EU. Review what each feature does and ask your vendor for its classification in writing.
Does Colorado’s SB 26-189 apply to online proctoring?
It may. From January 1, 2027, the law covers automated decision-making technology that materially influences consequential decisions in education. Whether a proctoring feature does so depends on how it is used. The law includes specific accommodations for FERPA-covered institutions, so ask general counsel to review your case.
Can a proctoring vendor access student records under FERPA?
Yes, as a school official, if it meets three conditions. It must perform a function the institution would otherwise assign to its own staff. It must remain under the institution’s direct control over how records are used and maintained. And it must respect FERPA’s limits on redisclosure.
Can an institution discipline a student based only on an automated flag?
It’s not advisable. A flagged incident is a signal, not proof. The prudent approach is for a person to review each case using defined criteria, and for the student to be able to explain before any decision is made. Colorado and the EU AI Act both point in that direction.
Where to start
Review the map with the people involved in the decision: the provost’s office, general counsel, the privacy office, IT and the registrar. Check how many of the six decisions you’ve already settled, and give the rest an owner and a date.
Since 2012, SMOWL has helped +350 institutions worldwide run reliable, secure digital assessments. To see how these decisions work in your LMS, request a free demo or explore our proctoring plans.
