Your organization spent money on an online safety training program. Employees completed it. You have completion records. You feel confident that if something goes wrong, you can demonstrate due diligence.

You may be wrong.

Courts and regulators are increasingly drawing a distinction between online training that can be verified and online training that cannot. If your platform cannot confirm who completed the training and whether they actually participated, that training may not count when it matters most.

The Standard Has Changed

Workforce training moved from the classroom to the screen gradually, then all at once. The cost savings are real, the scheduling flexibility is genuine, and for many organizations online training is now the only practical option for reaching a distributed workforce.

But the shift to online created a problem that classroom training never had: how do you prove that the right person completed the training, and that they actually engaged with it rather than clicking play and walking away?

In a physical classroom, an instructor can confirm attendance and participation. Online, without the right technology, you cannot. And in high-risk industries, that gap has real legal consequences.

What the Courts Have Said

The landmark case of R. v. Rose's Well Services Ltd. made this problem impossible to ignore. During the investigation, an employee admitted to completing online training on behalf of other employees. The employer had training records. The employer had completion data. None of it mattered, because the records could not demonstrate that the right people had actually done the training.

Courts determining fault in workplace incidents use due diligence as a central test. Did the employer take all reasonably practical steps to prevent the incident? Providing online training that cannot be verified does not satisfy that test.

The legal counsel of a multinational energy company put it plainly:

"Making our safety orientation and training available on the web and requesting that personnel take the training without the ability to provide documented evidence that personnel had actually completed the required safety orientation and training would, in my opinion, not be reviewed positively in an analysis of whether a company had satisfied its due diligence requirements in the event of an incident. Due diligence is a company's only defense against a strict liability offense."

That is not a hypothetical risk. It is a legal opinion from inside a major organization that had already thought carefully about what their online training program would look like in front of a judge.

The Three Risks Unverified Online Training Creates

Someone else completes the training

Without identity verification, there is no way to confirm that the person who registered for the training is the person who completed it. The Rose's Well Services case is not an isolated incident. Proxy completion is a known problem in workplace training, particularly for mandatory compliance courses that employees view as a checkbox rather than a learning opportunity.

The learner clicks through without engaging

Completion records show that a course was finished. They do not show that anyone watched it, read it, or absorbed any of it. A learner who clicks play, leaves the room, and returns to click through the assessment has a completion record identical to one who engaged with every module. In a regulatory investigation, that distinction matters.

The record cannot be defended

Even if training was completed legitimately, an employer who cannot provide documented evidence of who completed it and how they participated is in a weak position. Regulators and courts do not give credit for training that cannot be verified.

What Some Organizations Have Done in Response

Some organizations, including Spectra Energy, have responded to this problem by removing online training from high-risk content categories entirely, citing security concerns around confirming student attendance. That is a significant operational step backward.

The Chartered Professionals in Human Resources of Alberta has taken a different position, advising that technology exists that mitigates the issues facing compromised training by verifying both the identity and participation of trainees.

That technology exists. The question is whether your organization is using it.

What Verifiable Online Training Looks Like

Verified online training confirms three things that unverified training cannot:

• Identity — the person who registered is the person completing the training
• Participation — the learner was present and engaged throughout the session, not just logged in
• Documentation — a record exists that can be produced in a regulatory investigation or legal proceeding and withstand scrutiny

Integrity Advocate has worked with organizations across construction, mining, oil and gas, and other high-risk industries to help hundreds of thousands of personnel complete training online in a way that meets regulatory standards and holds up as evidence of due diligence.

The difference between online training that counts and online training that does not is not the content of the course. It is whether you can prove who did it and that they were there for it.

The Choice Every Employer Needs to Make

Organizations running online workforce training face a straightforward decision. Implement training without identity verification and participation monitoring, and accept the legal and regulatory exposure that comes with it. Or implement training with the technology to verify both, and be able to demonstrate due diligence if it ever matters in court.

With Integrity Advocate, that second option does not require rebuilding your training program. It works with your existing LMS and course content, adding the verification layer that transforms a completion record into a defensible document.

{{post-cta}}

When a proctoring tool violates a participant's privacy, who is responsible? The software vendor? The organization that deployed it? Both?

Recent legislation and court decisions from Canada, the UK, and the United States have answered this question with increasing clarity: the liability rests with the organization running the testing, not the software provider. For anyone deploying online proctoring, this is not an abstract legal point. It is a direct operational risk.

The Core Issue

Organizations that deliver online training and testing have a legitimate need to confirm who is taking their assessments and that participants are engaging in good faith. Meeting that need often requires collecting sensitive personal data: ID images, biometric verification, session recordings, and audio. The question of who bears legal responsibility for how that data is handled has been answered by courts and regulators in ways that most organizations have not fully reckoned with.

The consistent finding across multiple jurisdictions is that the data-collecting organization, not the software vendor, is the accountable party.

CASL: The Canadian Perspective

Canada's Anti-Spam Legislation was created in 2014 to reinforce best practices in electronic communications and combat spam and related cyber threats. Among its provisions, CASL requires organizations to obtain consent and written acknowledgement before using invasive computer programs, and to provide users with assistance in removing such programs afterwards.

Under CASL, software is considered invasive if it interferes with the user's control of their computer system by opening programs, printing, or accessing files without their knowledge, or if it changes system settings, preferences, or commands without their knowledge.

Online proctoring tools that block restricted sites, monitor web use, require camera access, or install browser extensions clearly fall within this definition. And most proctoring plugins do not provide uninstall assistance, remaining active by design after the session ends to reduce support overhead for the vendor.

The risk for organizations: CASL violations carry regulatory penalties of up to $10 million per violation. If your proctoring system leaves you liable to CASL noncompliance, that exposure belongs to you, not your vendor.

GDPR: The Global Standard That Places Liability on the Data Owner

The EU's General Data Protection Regulation has established a universal standard for data privacy that reaches any organization handling the personal data of EU residents, regardless of where that organization is based.

Under GDPR, the organization running the testing is the data controller, while the proctoring tool is the data processor. Fines for inappropriate collection, storage, transfer, or deletion of personal data fall on the data controller, not the data processor.

Ireland's Data Protection Commission made this distinction explicit in a judgment against Slane Credit Union Limited, stating that processors cannot be used by controllers as a legislative safety net, and that it is essential that due diligence is carried out to ensure the protection of personal data.

GDPR fines can reach 20 million euros or 4% of a company's total worldwide annual revenue, whichever is higher. The liability for how a proctoring vendor handles learner data belongs to the organization that chose to deploy it.

BIPA: The Illinois Warning

American organizations are increasingly coming under regulatory scrutiny for proctoring practices. Illinois' Biometric Information Privacy Act is one of the most consequential examples.

BIPA places liability on organizations when biometric data is collected or used in a way that violates participant privacy, including failing to secure written consent and failing to publish a retention schedule outlining when data will be permanently destroyed.

Two landmark cases illustrate how serious this exposure can be.

BNSF Railway Co. was subject to a $228 million jury verdict for scanning the fingerprints of truck drivers without consent. The case was eventually settled for $75 million. The third-party vendor that provided the scanning technology was not implicated in the charges.

White Castle System Inc. faced a separate BIPA lawsuit in which the Illinois Supreme Court ruled that claims accrue with each individual finger scan, exposing the restaurant chain to a potential liability in the billions of dollars. White Castle ultimately settled for approximately $10 million. Again, the vendor supplying the technology was not the party held accountable.

The pattern across both cases is consistent: the organization that deployed the biometric technology bore the liability. The software vendor did not.

Cleveland State: A Fourth Amendment Violation

In 2022, a federal court found that Cleveland State University's remote testing requirement of a room scan constituted unreasonable search and seizure in violation of students' Fourth Amendment rights.

Cleveland State used two separate proctoring providers to facilitate these scans. Both were named in the decision. Neither was fined. The university bore the consequences.

This case illustrates two important points. First, the room scan requirement itself was the violation, regardless of which vendor implemented it. Second, choosing a proctoring tool that conducts room scans does not transfer the legal risk to the vendor. The organization that required the scan is the one that faces the consequences when that requirement is found to violate participant rights.

What This Means for Online Training and Testing Providers

These cases are not outliers. They reflect a consistent and accelerating trend in privacy legislation globally: organizations are responsible for the actions of any third-party software, plugins, or services they deploy. Vendor liability does not substitute for organizational accountability.

For organizations delivering online training and testing, this has direct implications for vendor selection. The question is not just whether a proctoring tool works. The question is whether deploying it creates liability for your organization under CASL, GDPR, BIPA, or other applicable legislation.

The steps that reduce that liability are straightforward: choose a vendor with documented privacy practices, confirm that data handling complies with the legislation applicable to your jurisdiction and your learners' jurisdictions, require clear data deletion timelines, and ensure that any software deployed on learner devices complies with consent and removal requirements.

How Integrity Advocate Approaches This

Integrity Advocate is designed to reduce the compliance exposure that comes with deploying a proctoring tool, not to add to it.

No installation is required in most cases, which eliminates CASL's invasive software provisions entirely for the majority of deployments. Data is collected only for its stated purpose and deleted by default within 24 hours of session completion. Consent is obtained before any data collection begins. Data is stored in GDPR-designated jurisdictions. Room scans are optional rather than mandatory, and can be enabled or disabled based on the organization's assessment of their necessity and proportionality.

These are not policy commitments. They are architectural decisions built into how the platform works.

{{post-cta}}

Credentials that carry real professional consequence. The landscape has shifted and it is not slowing down.

In the video above, we trace how assessment delivery has evolved from in-person exams to global remote testing and why each shift has required a new approach to protecting integrity. Today’s environment requires a modern assessment security strategy designed for AI, scale, and trust.

The Landscape Has Shifted

Assessment did not begin online. It moved there. For decades, integrity relied on physical oversight in classrooms and testing centers. As programs expanded, online exams increased access and flexibility. Then the COVID surge accelerated remote assessment almost overnight. What began as an emergency solution became a long-term operating model for many institutions and credentialing bodies.

As delivery models evolved, security had to evolve as well. The challenge now is that change is happening faster and across more dimensions at once.

The AI Era Has Changed the Risk Equation

Generative AI has fundamentally altered how information is accessed, created, and submitted. Tools powered by artificial intelligence can draft essays, solve complex problems, generate code, and replicate writing styles within seconds.

Wiley’s large-scale academic integrity research found that a growing percentage of students acknowledge using AI tools in academic settings, and many instructors report increased concern about AI-assisted misconduct in online exams. The issue is not theoretical. It is active and expanding.

Traditional remote proctoring models were built to detect visible behaviors such as a second person in the room or suspicious movements. AI-assisted misconduct often leaves fewer visible signals. The risk is increasingly digital rather than physical.

Programs must now account for:

• AI-generated responses submitted during online exams
• Real-time AI assistance on secondary devices
• Screen-to-phone workflows that avoid camera detection
• Rapidly evolving generative AI tools

At the same time, institutions cannot simply increase surveillance. Wiley research also shows that student trust and perceptions of fairness directly influence engagement and compliance. Excessively invasive monitoring can undermine that trust.

Modern assessment security in the AI era requires a layered approach:

• Intelligent detection signals
• Contextual analysis
• Trained human review
• Clear, defensible documentation

AI can identify patterns at scale. Human expertise provides interpretation and fairness. The objective is not to monitor more. It is to respond intelligently to how misconduct has evolved.

Scale and Access Have Redefined Expectations

Programs now serve global audiences across time zones and devices. Certification pathways are expanding, workforce training is accelerating. According to recent industry market analysis, the global online proctoring market is projected to continue growing at a strong compound annual growth rate over the next several years, driven by remote testing demand and enterprise credentialing needs.

As access scales, candidates expect experiences that are simple, device-friendly, and reliable. Programs need solutions that integrate into their LMS platforms, require minimal setup, and support growth without creating operational strain.

Research from Wiley indicates that students are more likely to report positive testing experiences when the process is straightforward and transparent. Complexity and technical barriers reduce confidence in the assessment process.

Modern assessment protection must:

• Work across devices and real-world environments
• Minimize unnecessary technical hurdles
• Integrate directly with LMS systems
• Scale without increasing manual administrative work

Ease of use is no longer a convenience. It is directly tied to program adoption, student trust, and operational sustainability.

Security must scale as confidently as the programs it protects.

Privacy and Trust Are Non-Negotiable

As digital assessment expands, privacy expectations intensify.

Wiley research highlights that students care deeply about how their data is collected, stored, and used. Concerns around surveillance and data retention influence perceptions of fairness and institutional trust.

At the same time, regulatory frameworks around data protection continue to evolve globally. Institutions must balance integrity with compliance and reputational risk. Security that compromises privacy ultimately weakens credibility.

Programs increasingly seek approaches that:

• Minimize unnecessary data collection
• Avoid excessive long-term storage of exam data
• Provide contextual human review rather than automated punishment
• Deliver defensible and transparent outcomes

Trust is part of assessment integrity. A secure system must protect both the exam and the relationship between the organization and the candidate. Integrity and privacy must coexist.

Credentials Carry Long-Term Consequences

Assessments are no longer isolated academic exercises. They connect directly to employment decisions, professional licensure, workforce mobility, and digital credential verification. Industry market analysis shows that employers increasingly rely on verified credentials as part of hiring and advancement decisions.

When exam integrity is compromised, the value of the credential is compromised. When credentials lose credibility, the entire ecosystem is affected.

Programs are therefore focusing not only on detection but on defensibility:

• Clear audit trails
• Consistent enforcement standards
• Transparent review processes
• Long-term protection of credential credibility

Assessment security is about preserving trust in outcomes, not simply preventing violations during a single session.

Why a Tool Is No Longer Enough

In this environment, selecting a proctoring solution becomes a strategic decision. Organizations need more than software that flags behavior. They need a partner that:

• Understands AI-era risks
• Invests in research and thought leadership
• Balances intelligent detection with human judgment
• Supports scalable growth
• Adapts to evolving regulations and technology

Security is no longer a static feature. It is an evolving system. Standing still is the greatest risk.

Built for What Is Next

Integrity Advocate was designed for this reality. We combine AI-powered detection with trained human review to deliver assessment security that adapts to your program’s needs. We prioritize privacy, minimize unnecessary data storage, and support flexible proctoring options that work across devices and environments.

More importantly, we treat assessment integrity as an ongoing partnership. Three things are certain:

The landscape will continue to change.
Technology will continue to advance.
New risks will continue to emerge.

The organizations that succeed will be those who choose strategies and partners built to evolve alongside them. Is your strategy is built for what is next?

{{post-cta}}