Generative AI didn’t break assessment. It exposed how much we had quietly outsourced to the take-home essay.

For two decades, higher education moved steadily away from the invigilated hall. Take-home assignments, open-book papers and submitted projects were easier to run, kinder to timetables, and - we told ourselves - better aligned with how graduates actually work. Then generative AI arrived, and a format that rested on the assumption “this is the student’s own unaided work” could no longer carry that weight on its own.

The sector’s response has been visible and, in places, abrupt: a return to closed-book examination. Not everywhere, and not for everything - but for the assessments where authorship and identity genuinely matter, institutions are once again asking candidates to demonstrate competence under controlled conditions. The instinct is right. The execution is where it gets hard.

CLOSED-BOOK IS NOT ONE THING

The phrase “closed-book exam” hides an enormous range of risk and control. A reflective in-class essay on paper is closed-book. A high-stakes professional licensing exam taken remotely is also “closed-book”. Treating them as the same problem - and applying the same security to both - is how institutions end up either over-policing low-risk assessments or under-protecting high-stakes ones.

The useful question is not “open or closed?” It is “how much assurance does this specific assessment need, and at what cost to the candidate experience?” Security is a dial, not a switch.

WHAT MANY INSTITUTIONS DO - AND WHY IT DOESN’T SCALE

Faced with an urgent integrity problem, the common reaction is to reach for a quick fix: a lockdown browser bought for a department, a third-party proctoring tool trialled for a single high-stakes module, or a blanket rule that “all exams now use webcams”. These ad hoc measures share three weaknesses.

• They don’t scale. A tool procured by one faculty becomes a support burden no one owns. A dozen point solutions across an institution mean a dozen contracts, a dozen data flows and a dozen different onboarding experiences for students.

• They struggle on compliance. Many proctoring tools route biometric data - faces, voices, room scans - through servers outside the EU, with retention the institution never really controls. Under GDPR and the EU AI Act, that is precisely the high-risk processing that now demands a documented, defensible basis.

• They create an inconsistent student experience. A candidate who meets a different surveillance regime in every module - some heavy, some light, none explained - is a candidate who, rightly, starts asking questions about proportionality and fairness.

Ad hoc works for a pilot. It does not work as policy.

WHAT GOOD LOOKS LIKE: PROPORTIONATE, SCALABLE, COMPLIANT

A serious approach to exam security has three properties. It is proportionate - the level of control matches the stakes of the assessment, chosen exam by exam rather than imposed institution-wide. It is scalable - one platform, one data flow and one student experience, whether you are running fifty candidates or thousands. And it is compliant by design - EU hosting, GDPR-aligned processing, defined retention and a clear audit trail, so that the integrity measure does not itself become a data-protection liability.

Get those three right and security stops being a series of emergencies and becomes a setting you choose with confidence.

HOW UNIwise THINKS ABOUT THIS - FOUR LEVELS, ONE PLATFORM

WISEflow treats assessment closed book integrity as a layered choice, not a single policy. Institutions pick the level - or the combination - that fits each assessment, all within one platform and all under the same GDPR-aligned, EU-hosted data processing, with defined retention for any captured media.

1. Device Monitor (monitoring). Full desktop access with complete activity logging, periodic screen capture and reviewable evidence. Best for tool-heavy exams — Excel, programming, CAD — that can’t run inside a locked-down browser but still need an integrity trail.

2. Lockdown Browser (lockdown). A dedicated client that confines the candidate’s device to the exam: no other apps, no copy-out, no unauthorised navigation, with built-in tools such as drawing, webcam capture and a code/LaTeX editor. Best for standard closed-book essay or MCQ exams that need a controlled environment.

3. Facial Comparison + Audio Detection (soft invigilation). Automated invigilation layered onto the lockdown browser — image capture matched against the student’s reference photo, configurable flags on low match scores, and voice detection with live transcription. It confirms the right person sits the whole exam, without a live human watching every candidate. Best for remote or on-site closed-book exams that need identity and presence assurance.

4. Full Proctoring (proctoring). Fully proctored online exams inside WISEflow — automated ID verification, webcam, screen and audio recording, an optional mobile second-camera room view, and your choice of review: self, AI, live human or post-exam. Browser-based, nothing to install. Best for high-stakes remote exams that need real-time supervision and a defensible record.

Because these levels live in one platform, an institution can run a low-touch Device Monitor exam in the morning and a fully proctored licensing exam in the afternoon - same system, same data governance, same student login.

THE POINT

The closed-book comeback is a sensible answer to AI. But “we’ve gone back to closed-book” is the start of the conversation, not the end of it. The institutions that will hold up to scrutiny — from students, data protection authorities and the press — are the ones that can show why each assessment carries the security it does, that the approach scales across the whole institution, and that every captured image, recording and log sits on EU infrastructure under clear rules.

That is the brief WISEflow is built for.