A few years ago, the concern about AI in online assessments was theoretical. Today it is not. GPT-powered browser plugins can prefill answers to multiple choice exam questions the moment they appear on screen, regardless of the topic or difficulty level. The learner does not need to read the question. They do not need to understand it. The answer is already there.

Integrity Advocate has been tracking this development closely. The response is ExposeAI, a new detection capability built directly into Integrity Advocate's monitoring suite.

How GPT-Powered LMS Plugins Work

Learning Management System plugins powered by generative AI have proliferated rapidly. Among the tools currently in use are Github Copilot, AnswersAI, ConchAI, Jasper, ChatSonic, Coursology, Hyperwrite, Quillbot, and Monica, among dozens of others that continue to emerge.

These tools share several characteristics that make them particularly difficult to address through standard LMS countermeasures:

• They are inexpensive or free to obtain
• They require no technical expertise to install or activate
• Once installed, they operate automatically and continuously
• They are designed to conceal their presence and adapt to detection attempts
• New variants emerge faster than most platforms can respond

As a result, organizations relying on their LMS provider to develop effective countermeasures are unlikely to find one. LMS companies have no current solutions to this threat, and the nature of these plugins makes them unlikely to be eradicated through platform-level defenses alone.

The integrity of online assessments and certifications depends on a different approach.

Why This Matters for Assessment Integrity

The implications extend beyond academic dishonesty. For organizations issuing certifications that carry regulatory or legal weight, an assessment completed with AI assistance is not a valid measure of knowledge or competency. The certification it produces is as hollow as one issued without any training at all.

The same worker who received a fraudulent safety certification from a provider that did not deliver training could receive an equally fraudulent certification from an organization that delivered the training but could not prevent AI tools from completing the assessment on the learner's behalf. The outcome is the same: a credential that does not reflect what the person actually knows.

Introducing ExposeAI

ExposeAI is Integrity Advocate's purpose-built response to AI-assisted assessment fraud. It can be incorporated into Integrity Advocate's existing monitoring suite without any technical effort from clients, and works across the full range of devices and browsers that Integrity Advocate supports, from mobile to desktop.

ExposeAI is designed to detect the presence and use of GPT-powered plugins during an assessment session, giving organizations the visibility they need to maintain the integrity of their certification and training programs in an environment where AI tools are becoming standard equipment for learners looking to shortcut the process.

This is part of Integrity Advocate's broader commitment to staying ahead of the threats that matter most to the programs it serves. Human review remains at the core of every session. ExposeAI adds a layer of detection specifically designed for the AI-assisted cheating methods that automated systems alone cannot reliably identify.

The Broader Picture

AI cheating tools are not a passing trend. They are becoming cheaper, more capable, and more widely available. Organizations that do not have a response to this threat are issuing certifications they cannot stand behind.

Integrity Advocate's approach combines human review with purpose-built AI detection, so the results your program issues reflect what learners actually know, not what an algorithm answered for them.

{{post-cta}}

Corporate training serves many purposes. Meeting regulatory requirements. Building workforce capabilities. Demonstrating due diligence. But across all of these purposes, the same assumption is made: that a training completion record is proof that training happened.

It is not.

A completion record is proof that training was accessed. It is not proof of who accessed it, whether they engaged with it, or whether the person on record is the person who actually completed it. In a regulatory investigation or legal proceeding, that distinction matters enormously.

The PricewaterhouseCoopers Case

PricewaterhouseCoopers is one of the Big Four accounting firms and the second-largest professional services network in the world. In a published regulatory investigation conducted by the Canadian Public Accountability Board, fines of over one million Canadian dollars were assessed after it was found that junior staff, managers, directors, and partners of PwC shared answers to internal training courses on auditing, accounting, and professional independence.

The regulator found that PwC had failed to establish policies and procedures to provide the firm with reasonable assurance that its workforce was completing required training as intended.

This was not a small organization with limited resources. This was one of the most sophisticated professional services firms in the world, with dedicated compliance infrastructure. And still, the internal training program failed to verify that the right people were completing the right training.

If it can happen at PwC, it can happen anywhere.

What Regulators Actually Require

Conversations with private company leaders reveal a consistent gap in understanding. Regulators generally do not stipulate specific oversight requirements for how training must be delivered or verified. They specify the outcome: that the workforce is trained.

The assumption that providing access to online training satisfies that outcome is where organizations get into trouble. Online training records are proof of training accessed, not training completed, and not by whom. Company leadership often has no evidence of individual workers' participation, and no process in place to obtain it.

When a regulatory investigation or legal action follows a workplace incident, that gap becomes the story.

Why Insurance Does Not Solve This Problem

When facing regulatory or legal action, many organizations turn to insurance protection as a backstop. It is worth understanding what insurance does and does not cover.

Insurance policies do not cover bad faith or gross negligence. The argument that company leaders have demonstrated gross negligence rests on the definition established in Hart v. Kline (1941): gross negligence as an indifference to a legal duty of care. An organization that provided training access without any mechanism to verify who completed it, or whether they engaged with it, may find that argument difficult to counter.

A completion record that cannot confirm identity or participation is not a defense. It is evidence of the gap.

What Verified Internal Training Looks Like

Integrity Advocate works with organizations to close that gap by verifying the identity and confirmed participation of internal personnel in every training session. The result is a record that demonstrates not just that training was accessed, but that the right person completed it and was present throughout.

This eliminates the exposure that comes from unverifiable training records in regulatory investigations, legal proceedings, and insurance disputes.

As one client senior leader put it: "How we deliver information to our personnel is indicative of the importance of that information to them."

The way an organization approaches training verification sends a signal about how seriously it takes what it is training people to do. For compliance training, safety training, and any instruction with regulatory or legal weight, that signal matters.

{{post-cta}}

Most people assume fraud means stealing or pretending to be someone else. In the world of workplace training and certification, the definition is broader than that. Fraud is also when a person receives credit for something they did not, in fact, do.

That definition has real consequences for employers, and two recent cases make it impossible to ignore.

When Certifications Become Fraudulent

In Australia, a registered training organization was charged with issuing false documents to multiple trainees. The organization marked participants as attending a full two-day training when they had actually left at noon each day. Participants received certifications to operate forklifts and erect scaffolding without meeting the full training requirements. The organization faced significant financial penalties as a result.

In Canada, the Royal Canadian Mounted Police uncovered a large-scale counterfeiting operation selling fake training certifications for safety credentials including H2S Alive and First Aid/CPR. H2S Alive is issued to people working with hydrogen sulphide, a highly flammable and toxic chemical. The people who purchased these certificates did not miss half a course. They did not participate in any training at all.

In both cases, employees and their colleagues were put at risk. That risk includes injury, loss of limb, and death.

Why This Happens More Often Than Organizations Realize

It is far too common for certificates to be issued without confirming identity or full participation. Most people do not think twice about the consequences of leaving a training session early. Few would assume that attending training where identity and attendance are not confirmed could result in a regulator declaring their certificate fraudulent.

But that is exactly what happens.

Employers carry a legal and moral responsibility to protect their employees and their organization from risk. Employee certifications are a promise to colleagues, clients, and regulators that your workforce meets industry standards. If you cannot demonstrate that your employees actually completed the required training, that promise is hollow and the certification that represents it may be worthless.

Without a trusted mechanism to verify identity and participation, the consequences range from reputational damage to financial penalties to legal action.

Who Is at Greatest Risk

Workers who operate heavy machinery or work with dangerous chemicals face the highest physical risk from fraudulent certifications. But employees across all roles must be able to demonstrate proof of training that holds up to scrutiny.

The Australian case resulted in financial penalties and a loss of public trust. For organizations in regulated industries, that combination of reputational and financial damage can have lasting consequences that far exceed the cost of implementing proper verification in the first place.

How Organizations Are Addressing This

The solution starts with how training organizations are selected and evaluated. For in-person training, careful vetting of providers is essential. For online training, which now accounts for the majority of workplace learning, the training organization must use an identity verification and participation monitoring solution.

Effective online proctoring uses a combination of human review and AI to verify that the right employee takes the right training and stays engaged throughout, without adding significant cost or administrative burden.

Safety-conscious businesses and industry safety organizations are increasingly requiring verified training, allowing them to take advantage of online delivery without compromising legal compliance or risk management. This trend is accelerating across industries where the consequences of unverified training are most severe.

Choosing verified online training gives employers documented evidence that their workforce completed training as required, evidence that holds up in regulatory investigations and legal proceedings.

{{post-cta}}