Identity verification before an online exam

What exam providers ask of identity checks

A university or a certificate body that runs an exam online is asked the same thing by everyone who relies on the result: how do you know who took it? In a hall the answer is a person with a list and a photo card. At home the answer has to be built. The simplest honest version is a check just before the paper opens: the student shows the document that was used at enrolment, a live face is compared with the portrait on it, and only then is the exam link released.

That check is narrow on purpose. It answers one question once, and it leaves the exam itself to the institution. The page that follows keeps to that boundary, because the law on artificial intelligence treats confirming a person's identity and watching a person during a test as two different things.

• Confirm, before the paper opens, that the student is the person on the document.
• Accept the documents that students in different countries hold.
• Compare a returning student with a stored reference face at a later sitting.
• Show the service in the language of the student, one of 90+ languages.
• Keep a record of each check and let a staff member decide a case that the check does not settle.

The flow

1. Registration. The student registers for the exam in the institution's own system, which holds the registered candidate's name, birth date and the document used at enrolment. The platform does not run registration.
2. Start. Shortly before the exam, your backend creates a session and sends the student a one-time link, or the student scans a QR code to move from a desktop to a phone.
3. Document. The student photographs a passport, national ID card, driver's licence or residence permit. The document is read and checked for fraud.
4. Selfie and liveness. The selfie is matched to the document portrait and active liveness confirms a live person.
5. Next sitting. At a later exam, a returning user is compared with a stored reference face.
6. Match to the registration. The platform compares the selfie with the document portrait and, at a later sitting, with a stored reference face. It does not match anything against the institution's enrolment records. Your own system compares the name and birth date read from the document with the registered candidate and ties the result to that candidate's exam attempt in its own records.
7. Mismatch or failure. When the names differ, the check fails or the session is left incomplete, the exam link is held back and a staff member decides the case in the dashboard, so an exam is not started on a result that is not tied to the registered candidate.
8. Release. Your system reads the session status or receives a webhook, and its own rule releases the exam link or holds it back. A case that needs a person is decided manually in the dashboard.
9. Record. Retention is a setting you choose per scenario, and erasure on request is available through the API.

Where this differs from the education page

The education page is about enrolment: a cohort is invited, documents are checked, duplicate applicants are found. This page is about a later moment, the exam, where the same person has to be confirmed again and where a second kind of tool, monitoring, sits nearby. The identity check is a gate at the door. It is not a camera in the room, and the regulation below draws that distinction in its own words.

Modules used

• Document verification, face verification and liveness.
• Web SDK and widget with one-time links and QR hand-off.
• Dashboard for the session log and the manual decision.
• REST API and webhooks to connect the exam system.
• Data controls for retention and erasure.

Regulatory frame

One European Union text: Regulation (EU) 2024/1689, the AI Act, in the Official Journal text. It says it applies from 2 August 2026, with the exceptions it lists. Later amendments are not covered here.

• Article 3, point (36), defines biometric verification as the automated, one-to-one verification, including authentication, of the identity of natural persons by comparing their biometric data to previously provided biometric data.
• Annex III, point 1(a), lists remote biometric identification systems among the high-risk systems, and adds that this shall not include AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be.
• Annex III, point 3(d), lists among the high-risk systems in education and vocational training the AI systems intended to be used for monitoring and detecting prohibited behaviour of students during tests in the context of or within educational and vocational training institutions at all levels.

This block describes the text, not our service. For information; not legal advice.

Sources

• Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence, Official Journal text, fetched 27 October 2026.

Next

Try the interactive tour, read about face verification or compare with the enrolment flow.