The EU AI Act for Sport and Sports-Tech: Most of It Is Minimal-Risk — Until It Isn't

Probably minimal-risk. For a sports club, league, federation or sports-tech vendor, the great majority of AI in use — performance analytics, tactical video analysis, fan-engagement personalisation, dynamic ticketing — carries no mandatory obligations under the EU AI Act, Regulation (EU) 2024/1689. The risk is concentrated in a handful of uses that look harmless but are not: biometric systems in the stadium, emotion recognition, hiring AI for staff, and generative fan content. Knowing which is which is the whole job.

The minimal-risk majority

Start where most of the AI lives. A model that analyses a midfielder's sprint data, an opponent-scouting tool that breaks down match footage, a recommendation engine that personalises a club app, a demand-prediction model that prices tickets dynamically — none of these appears in Annex III, none performs a safety function inside a regulated product, and none is a prohibited practice. They are minimal-risk: no conformity assessment, no FRIA, no mandatory stack.

That covers performance science, scouting analytics, broadcast and highlights automation, merchandising, and most fan-facing personalisation. The practical message for a sports organisation is the same as for most industries: do not assume the Act sweeps up everything. It targets specific uses. Find those, document the rest in the inventory, and move on.

Where it bites: stadium biometrics and the Article 5 prohibitions

The sharpest exposure in sport is in the stands, not on the pitch. Two Article 5 prohibitions matter, and they are bans, not high-risk duties to be documented — in force since 2 February 2025 at the €35,000,000 or 7% tier (Article 99(3)).

Emotion recognition. AI that infers the emotional state of fans, staff or players from faces or behaviour is restricted. In the workplace — staff, and arguably contracted players as workers — emotion recognition is prohibited under Article 5(1)(f). A "crowd sentiment" camera system aimed at spectators is not a workplace use, but it is biometric processing and runs into the Article 5(1)(f) boundary and the biometric-categorisation rules; treat it as a red-flag use, not a marketing gimmick.

Biometric categorisation. AI that categorises spectators by biometric data to infer sensitive attributes — and any untargeted facial-image scraping to build a recognition database (Article 5(1)(e)) — runs into the prohibitions. Real-time remote biometric identification of crowds in publicly accessible spaces is itself prohibited for law-enforcement use with narrow exceptions (Article 5(1)(h)); a private stadium operator deploying live facial recognition on the crowd is in genuinely fraught territory and should treat it as a stop-and-assess use.

Where biometric categorisation or identification is lawful and not prohibited, it can be high-risk biometrics under Annex III point 1 — the one Annex III category that routes through the notified-body conformity procedure (Annex VII) — and/or carry an Article 50(3) notice duty. The headline: biometrics in a stadium is the use that turns a sports-tech project from minimal-risk into a prohibition-or-high-risk question overnight.

Staff hiring: Annex III point 4

A club or federation using AI to screen coaching candidates, analysts, commercial staff or front-office hires is running a high-risk Annex III point 4 employment system — the same rule that applies to any employer. Performance analytics on players is not employment-decision AI; an AI tool that screens job applicants is. The organisation is usually the deployer (Article 26) of a vendor tool. The deadline for stand-alone Annex III high-risk is 2 December 2027 under the Digital Omnibus, Regulation (EU) 2026/1744 (originally 2 August 2026).

Fan content and chatbots: Article 50

Generative AI for fan engagement — a club chatbot, AI-generated matchday graphics, synthetic commentary, an AI mascot that "talks" to fans — falls under the Article 50 transparency duties, which have applied since 2 August 2026: users must be told they are interacting with AI (50(1)), and AI-generated or manipulated content must be machine-marked as synthetic (50(2); generative systems already on the market before 2 August 2026 have until 2 December 2026). Both are design duties on the tool's provider — the club itself if it builds or white-labels the tool. A deepfake of a player or manager for promotional content needs the club's own 50(4) deepfake disclosure. These are light, manageable duties — but they are duties, in the €15,000,000 or 3% tier (Article 99(4)).

The sports AI map

Worked example: Club Atlético Marenostrum SAD

Club Atlético Marenostrum SAD, a Spanish football club with about 280 staff and roughly €46M turnover, audits its AI. Most of it is minimal-risk: a player-load analytics suite, an opponent-scouting video tool, an app recommendation engine, and dynamic ticket pricing. Three uses need real attention. A proposed "fan emotion" camera trial in the stands is dropped after the audit flags it against Article 5(1)(f) and the biometric-prohibition boundary — not a documentation task, a no. A vendor AI tool for shortlisting commercial-department hires is Annex III point 4 high-risk, with the club as deployer (Article 26) and a 2 December 2027 deadline. A new generative-AI matchday chatbot must tell fans they are talking to AI (Article 50(1)), and its AI-made graphics must carry 50(2) machine-readable marking — design duties the club checks its vendor meets. The club's compliant position is mostly "minimal-risk, documented," plus one high-risk hiring tool, one transparency set-up, and one abandoned biometric idea.

How Confir helps

Confir classifies each sports AI use against the Article 5 prohibitions first — so a stadium emotion-recognition or facial-scraping idea is caught as a no before it ships, not documented as if it were merely high-risk — then runs Annex III logic for biometrics (point 1) and hiring (point 4), and flags the Article 50 transparency duties for fan-facing generative content. The engine is deterministic and rule-based: same intake, same finding, the rule that fired visible for an auditor. No consultants, no long rollout.

Related guides

• Prohibited AI practices (Article 5)
• Biometric categorisation AI
• Emotion recognition in the workplace
• Recruitment screening AI: high-risk?
• Article 50 transparency duties
• Minimal-risk AI explained