AI governance for clubs and sports organisations
In sport, the AI Act is often seen as remote, and it isn't. For clubs three areas make it immediately relevant: professional athletes are workers, stadiums are publicly accessible spaces, and supporter data is still personal data. For federations and promotion bodies the weight of administration is added, from member registration to courses for coaches and match officials.
The regulatory framework
- AI Act, Annex III: systems used for worker recruitment, evaluation and management are high risk, and professional athletes are workers
- AI Act prohibited practices and requirements for remote biometric identification in publicly accessible spaces, with direct impact on stadium access control
- GDPR Article 9, for athletes' health and biometric data
- Article 50 transparency obligations for content generated for the public
- Federation and league regulations, which add to rather than replace these requirements
- GDPR for fan base data, with attention to profiling, the legal basis for consent and the share of minors in a sporting audience
- AI Act, Annex III, education and vocational training: systems determining admission to a course, assessing an exam or monitoring a test for coaches and match officials are classified as high risk
- Further obligations where the body acts as a public-law body, starting with the fundamental rights impact assessment, with legal status to be verified case by case
Use cases and their risk level
| Use case | Classification | Note |
|---|---|---|
| Scouting and evaluation of professional athletes | High risk, Annex III | Falls within worker recruitment systems |
| Biometric monitoring and workload management | High risk if it affects contractual decisions | Health data under GDPR Article 9 |
| Facial recognition for stadium access | Strict constraints or prohibition | Biometric identification in a publicly accessible space |
| Dynamic ticket pricing | Minimal risk | Consumer information obligations apply |
| Fan base profiling and personalised campaigns | Minimal risk | GDPR consent and profiling obligations, with a significant share of minors |
| Assessment of exams and qualifications for coaches and match officials | High risk, Annex III | Education and vocational training area |
| Automated handling of registrations and affiliations | Assess case by case | Data on minors and medical fitness certificates |
| Generated content for club channels | Limited risk | Artificially generated content must be disclosed |
Where to start
- 1Separate systems affecting contracted athletes from those affecting the public, because they fall under different regimes
- 2Review any biometric recognition technology in venues before expanding its use, because this is the area with the strongest constraints
- 3Map sports analytics suppliers and define who is the provider and who is the deployer for each system
- 4Count how many supporters the club can contact directly, because the database is split across ticketing, e-commerce, app and social channels and a single view rarely exists
- 5For federations and promotion bodies, review the systems handling registrations, courses and qualifications, because they touch data on minors and can fall under Annex III through the vocational training route
What we do for the sector
The path is always the same and the content changes: it starts from the use case map, assesses impact before investing, validates with a prototype, and only then reaches production. Rapid prototyping runs through protot.ai, our validation unit.
Use case definition
We build the portfolio separating systems that touch contracted athletes, which fall among worker management systems, from those aimed at the public. It is a separation clubs and federations have rarely formalised, and it drives completely different obligations. On the public side the map starts from the data: how many supporters the club holds in its own database and how many remain reachable only through third-party platforms. For federations and promotion bodies the same map covers the administrative side, from member registration to courses for coaches and match officials.
Impact assessment
We assess sporting and economic impact alongside impact on people, which in athlete monitoring involves health data. For access control the assessment concerns what is permissible before what is useful, because it is the area with the strongest constraints.
Prototyping and validation
With protot.ai we validate hypotheses over a season or a narrow perimeter, which in sport is the fastest way to learn whether a scouting model genuinely adds information beyond the technical judgement already inside the club.
Production and oversight
In production we support integration with performance and ticketing systems, definition of roles relative to analytics suppliers, and oversight. On these systems the supplier is often a third party and the club remains accountable for how they are used.