ISO/IEC 17024: exam requirements and 2026 compliance matrix
For bodies that certify people and are preparing their remote exams.
Updated October 1, 2026
What is ISO/IEC 17024 and who issues the certification?
The certification body issues the certificate, and a national accreditation body such as UKAS or ANAB accredits it; ISO publishes the standard and certifies no one. The standard concerns how a body establishes a person's competence, not a company or a product.
Every exam is a certification assessmentCertification assessmentAn assessment whose result determines the award of a title, a degree or a certification. The stakes impose stronger requirements on candidate identification, on the fairness of sitting conditions, on the traceability of grading and on how long completed papers are retained afterwards.: its outcome decides the certificate. Accreditation bodies vary by country (UKAS in the UK, ANAB and IAS in the US, DAkkS in Germany), and the Global Accreditation Cooperation (Global ACI) arrangement recognizes their accreditations.
Who does what
Standard
ISO and IEC
Write and publish the international standard.
National edition
National standards body
Publishes the national edition, for example BSI in the UK.
Accreditation
Accreditation body
UKAS, ANAB and others accredit the body and list it in a public register.
Certification
Certification body
Defines the scheme, runs the exam, decides and issues the certificate.
Certificate
Certified person
Receives a certificate for a specific scheme.
What does the standard require for the exam?
The body must show that the exam set by the scheme, whether written, oral, practical or observational, measures competence in a valid, fair and reliable way, under proctoring and with protected material.
Six areas of the exam
Scheme
Prerequisites that can be met up to the decision, subject matter experts (clause 8).
Assessment methods
Fairness, validityValidityThe degree to which a test really measures what it claims to measure and supports the decisions drawn from it. An exam can be perfectly reliable and have no validity: it then measures something very stable, but not the competency it claims to assess. and reliabilityReliabilityThe consistency of a measurement: how far the same candidate would obtain a comparable score on sitting the test again, with other questions of the same kind or in front of a different grader. An unreliable exam produces grades part of which is nothing but noise. (clause 9.1.4), comparable results (clause 9.3.1).
Exam conditions
Network and IT equipment among the criteria (clause 9.3.3), calibrated equipment (clause 9.3.4).
Impartiality
The risk tied to the proctor, treated like the examiner's.
Proctoring and security
Prevent fraud and disclosure of material (clauses 3.16 and 7.4.4), identify technology threats (clause 7.4.2).
Decision and appeals
Certificate dated on or after the decision (clause 9.4.8); complaints and appeals more traceable (clauses 9.8 and 9.9).
What are the key changes in ISO/IEC 17024:2026?
ISO published ISO/IEC 17024:2026 in March 2026, the first revision since the 2012 edition, and it makes real-time proctoring the rule.
Six changes for the exam
Proctoring (clause 3.16)
Now covers remote presence and the use of AI.
Real time (clause 7.4.4)
Required, remote included, unless another method has proven effective: live proctoringLive proctoringSupervision by a human proctor who follows candidates in real time during the session and can intervene, ask for a sweep of the room or stop the exam. It is the most expensive mode, and the only one that allows an incident to be dealt with as it happens. meets that requirement.
AI (clause 6.5)
Monitoring, validation by experts, human oversight, transparency toward the candidate.
Impartiality (clause 4.3.5)
Manage and demonstrate bias risks when AI is used.
Privacy (clause 7.3.2)
Policies and procedures specific to data.
Risks and opportunities (clause 10.6)
Replace the preventive actions of the 2012 edition.
Transition calendar
March 2026
ISO publishes ISO/IEC 17024:2026.
ISO catalog, edition 3.
September 10, 2026
The Global ACI announces its transition requirements.
Document Global ACI-TECH-3-TR 2029-03-31.
October 1, 2027
Accreditation bodies announce their arrangements.
ANAB self-attestation due the same day.
October 2027 to September 2028
ANAB assesses its bodies against the 2026 edition.
March 31, 2028
Certification bodies declare their readiness.
To their accreditation body.
March 31, 2029
End of the transition.
Initial certification and recertification to the 2026 edition.
Is there an ISO/IEC 17024:2026 compliance checklist for remote exams?
Here it is. No platform complies with ISO/IEC 17024, which applies to the body: the matrix gives what the body must demonstrate, with what evidence, and what Evalmee can provide.
The Evalmee column describes features, not a self-assessment; the comparison of online exam platforms sets vendors side by side.
| Clause | What the body must demonstrate | Typical evidence | What Evalmee can provide |
|---|---|---|---|
| 3.16 Proctoring, remote or with AI | Exam proctored against fraud and disclosure. | Proctoring procedure, recordings. | Organization plan: webcams, microphone and screen sharing recorded; screenshot at each window exit. |
| 7.4.4 Real-time proctoring | Real time, or an alternative method shown to be effective. | Assigned proctors, session reports. | Several rooms live, chat, timestamped events. |
| 6.5 Use of AI | AI monitored, validated by experts, candidate informed. | AI policy, log of validations. | AI-assisted grading, mandatory human validation. |
| 4.3.5 Bias with AI | Bias managed. | Impartiality risk analysis. | Fraud risk score from fixed rules, no AI; the proctor decides. |
| 7.3.2 Privacy | Specific policies and procedures. | Impact assessment, privacy notice, Article 28 contract. | DPA, data in the EU, configurable retention (three months by default). |
| 7.4.2 Technology threats | Threats identified and addressed, AI included. | Threat analysis, vendor documentation. | Screenshot on application switch, full-screen exit or suspicious browser extension. |
| Candidate identity (no new clause) | The admitted candidate takes the exam in person. | Identity check. | Organization plan: photo and ID reviewed by a person; optional biometrics. |
| 9.1.4 and 9.3.1 Reliability and comparability | Results comparable across candidates and sessions. | Analysis by session, question bank. | Random draw and order; PDF and Excel export. |
| 9.3.3 Network and IT equipment | Technical conditions defined and under control. | Minimum requirements, handling of disconnections. | Internet outage: answers saved on the computer and sent automatically when the connection is back, with nothing to switch on; outages and reconnections timestamped in the timeline. |
| 10.6 Risks and opportunities | Risks, suppliers included, addressed with actions. | Risk register, supplier evaluation. | DPA and vendor measures. |
How are UKAS and ANAB handling remote exams and the transition?
As of October 1, 2026, ANAB has published a dated timeline for the 2026 edition and recommends starting with a gap analysis on AI, competence and vendor oversight. UKAS has published nothing specific to this standard, only a general transition bulletin on September 16, 2026.
Whatever the accreditation body, a remote exam is assessed against the same clauses. In Italy, Accredia's RG-01-02 rev.04, in force from November 1, 2026, turns them into explicit remote-exam rules: a national example, not a requirement elsewhere.
What to define for a remote exam
Feasibility
Remote format chosen for the real fraud risks, with no more intrusive tools than they warrant.
System requirements
Candidate network and IT equipment (clause 9.3.3), tested on a representative range of hardware.
Proctoring mode
Real time, or another method shown to be effective (clause 7.4.4).
Exam procedure
Rules and incidents: a human check comes before any decision.
Candidate information
Devices and data collected announced before sign-in, use of AI explained (clause 6.5).
Question bank
A question bankQuestion bankA reservoir of indexed, reusable questions, classified by topic, level or competency. It allows an exam to be assembled by random draw, papers to vary from one session to the next, and the statistical history that makes a question reliable to accumulate, item by item. with random draw and a time limit per question make cheating harder.
Data protection: what does the GDPR require for remote proctoring?
In the European Union, remote proctoring of any exam or certification falls under the GDPR, whether the body is public or private.
Each country's data protection authority enforces it, and the European Data Protection Board (EDPB) brings them together so that it is applied consistently. The CNIL, France's data protection authority, set out its reading in a 2023 recommendation, not binding outside France, that Evalmee, a European company based in France, applies by default. How Evalmee processes the data is described on the security and GDPR page.
What the GDPR requires
Roles
The body is the controller, the vendor its processor (Article 28).
Before deployment
A data protection impact assessmentAnalyse d'impact (AIPD, French data protection impact assessment)Analyse d'impact relative à la protection des données: according to the CNIL, a tool for building a processing operation that complies with the GDPR and respects privacy. It is required for processing operations likely to result in a high risk to the rights and freedoms of the people concerned. with the data protection officer (DPO) when the risk is high (Article 35).
Proportionate proctoring
Data minimization (Article 5): recording the whole exam is justified with the DPO.
No automated decision
An alert may flag a situation, never fail a candidate on its own (Article 22); the body weighs the fraud risk score with its DPO.
Biometrics
Facial recognition prohibited unless an exception applies, such as explicit consent (Article 9).
Access and retention
Set in advance by the body and stated in the candidate notice.
What Evalmee does and what stays with the body
Evalmee is not ISO/IEC 17024 certified and could not be: the standard applies to the body. The platform provides proctoring, identity checks and evidence, on the Organization plan; the proctor decides.
The fraud risk score is deterministic: fixed rules applied to logged events (exits from the exam window, copy and paste, second screen), with no AI and no behavioral analysis. It never decides: see the proctoring and monitoring page.
The full path: certification bodies, certification and degree exams.
Evalmee provides
- Live proctoring and recording of the exam (Organization plan).
- Every event timestamped in the session's audit trailAudit trailA timestamped log of every event in a session: sign-in, display of each question, successive answers, network incidents, proctor actions. It is what makes it possible to reconstruct a contested exam and to answer a complaint with something other than memory..
- Identity checked by a person (Organization plan); optional biometrics, under Article 9 of the GDPR.
- Connection to your tools: LTI 1.3, SSO, API, MCP server.
The body keeps
- The certification scheme.
- The exam procedure.
- The decision: the proctor decides, the platform documents.
- The session file.
Frequently asked questions
The personnel certification body, through a decision on a candidate who passed the exam set by the scheme. ISO publishes the standard and a national accreditation body, such as UKAS or ANAB, accredits the body: neither certifies people. Accredited bodies are listed in each accreditation body's public register.
Requirements for bodies that certify people: impartiality, the certification scheme, valid, fair and reliable assessment methods, exam proctoring, security of material, the decision, complaints and appeals. The 2026 edition requires real-time proctoring, remote included, unless another method has proven effective, and adds a clause on the use of AI.
A national accreditation body, such as UKAS in the UK, ANAB or IAS in the US, or DAkkS in Germany, has verified that the certification body applies the standard. Accreditation concerns the body; the person receives a certificate for a specific scheme. Accreditations are recognized under the Global Accreditation Cooperation (Global ACI) arrangement.
In the public register of each national accreditation body. UKAS, for example, publishes a searchable directory of the organizations it accredits, with their schedules of accreditation.
No. The standard applies to the certification body, which demonstrates the requirements with its own procedures and evidence. An exam platform helps with real-time proctoring, identity checks, recordings and exports, but no vendor can claim to be ISO/IEC 17024 compliant or certified in place of the body.
On March 31, 2029, according to the Global Accreditation Cooperation's September 2026 transition requirements: from then on, initial certification and recertification follow the 2026 edition. Accreditation bodies announce their arrangements by October 1, 2027 and certification bodies declare readiness by March 31, 2028; ANAB, for example, asks for a self-attestation by October 1, 2027.
Prepare your next exam session with Evalmee
Free trial, or a demo to check, clause by clause, what the platform covers.