How to Write an AI Policy for Exams

What an exam AI policy must define

Most exam AI policies fail on ambiguity rather than on intent. A policy that says AI use is prohibited leaves students guessing about spell-checkers, grammar tools, citation managers, and accessibility software, and leaves committees arguing about definitions at appeal. A workable policy defines three things concretely.

• Permitted tools: what students may use openly, such as approved calculators, reference documents, or assistive technology.
• Banned tools: what may not be used, named by category - AI answer assistants and overlay applications, generative chatbots, remote-control software, and unauthorized second devices.
• Disclosure requirements: whether and how students must declare tool use the policy allows but wants on record.
• Device rules: which devices may be present, whether secondary displays are permitted, and what monitoring software will run during the session.
• Consequences and process: what happens when a session is flagged, who reviews it, and how a student can respond.

Sample policy language you can adapt

The language below is a starting point for departments to adapt, not legal advice. It is written to be specific enough to enforce and plain enough for a student to understand before test day.

• Permitted tools: "During this assessment you may use the following tools: [list]. Any tool not listed as permitted is treated as prohibited for this assessment."
• Banned tools: "You may not use AI assistants of any kind, including chatbots, answer overlays, browser extensions, or editor plugins that generate or suggest answers. You may not use remote-control software, virtual machines, or a second device to obtain assistance."
• Monitoring disclosure: "This assessment is proctored. Software on your device records which applications and extensions are running, window and focus changes, and connected displays. A report of these observations is reviewed by [role] if the session is flagged."
• Review process: "A flagged session is reviewed by a person before any action is taken. You will be shown the evidence and given the opportunity to respond before a determination is made."
• Accessibility: "Approved assistive technologies are not affected by this policy. If you use assistive technology or require an accommodation, contact [office] before the assessment window."

Communicating the policy before test day

A policy students first see inside the exam is not a policy, it is a surprise. Publish it with the syllabus, restate it on the assessment page itself, and require an acknowledgement before the first proctored session. Disclosure is also what makes later enforcement defensible: a student who acknowledged a clear policy is in a very different position from one who encountered it for the first time in a hearing.

Keep the communication short. One page stating what is allowed, what is banned, what is monitored, and what happens on a flag outperforms a long document that no one reads.

Enforcing it fairly: evidence plus human review

Fair enforcement has two properties: it is based on what actually happened during the session, and a person decides. Browser-only proctoring cannot supply the first property, because the tools students are most tempted by - desktop AI assistants, overlays, remote control - run outside the browser and leave no trace inside it. Device-level detection supplies it by observing the operating-system layer where those tools run.

The second property matters just as much. No detection system catches everything, and no flag should punish anyone automatically. The defensible pattern is: the system reports timestamped observations, a reviewer examines them in context, the student is shown the evidence, and the institution's own process decides. Detect mode observes and flags; Prevent mode blocks restricted applications from launching during the exam window for assessments where the policy calls for it.

Where ScreenComply fits

ScreenComply runs alongside your LMS and any existing proctoring rather than replacing them. Inside Canvas, an assignment or quiz stays sealed until the student is genuinely being proctored, then unlocks for that student when the session goes live. The policy you publish is configured per session: which applications are restricted, whether the session runs in Detect or Prevent mode, and what accommodations apply.

Every session produces an audit-ready integrity report written for human review - an executive summary, a chronological evidence timeline, and the signal detail behind each entry - so the enforcement side of your policy rests on documentation rather than suspicion.