Sport · AI Act

Sport — AI Act: video analysis and biometric access

Sport makes use of AI for video-based performance analysis and, in some cases, facial recognition for venue access control. Under the AI Act, these use cases sit at very different risk levels. This guide clarifies their classification and the vigilance required around biometric data.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: AI Act.
  • Clubs, federations, and event organisers deploying AI are deployers; publishers are providers.
  • Qualify use cases.
  • Prohibiting unauthorised biometrics.
  • Ensure transparency.
  • Up to €35M or 7% for prohibited practices (unauthorised biometrics), on top of the GDPR risk relating to biometric data.

Regulatory deadlines

The key dates of this regulation.

August 2024

Entry into force

In force

February 2025

Ban on prohibited practices

In force

August 2025

General-purpose AI models (GPAI) & governance

In force

August 2026

High-risk system obligations (Annex III)

In force

August 2027

High-risk embedded in products (Annex I)

Upcoming

What does the AI Act cover?

The AI Act strictly regulates biometrics: real-time remote biometric identification in publicly accessible spaces is highly restricted, and biometric categorisation is regulated. Video-based performance analysis without biometric identification generally falls under limited risk.

Biometric data also constitutes sensitive data within the meaning of the GDPR.

Is the 'Sport' sector covered?

Clubs, federations and organisers deploying AI are deployers; publishers are providers. Biometric access devices call for the utmost caution.

Tactical and performance analytics, without biometric identification, is generally of limited risk.

Detailed obligations

Qualify use cases

Distinguish video analysis (limited risk) from biometrics (heavily regulated).

Prohibit unauthorised biometrics.

Ruling out facial recognition for access control except within a strict framework.

Ensure transparency

Inform about the use of AI and video.

Articulate with GDPR

Treating biometrics as sensitive data.

Sanctions & risks

Up to €35M or 7% for prohibited practices (unauthorised biometrics), on top of the GDPR risk relating to biometric data.

Application timeline

  • 1Entry into force. 1 August 2024.
  • 2Prohibitions. Biometric restrictions since February 2025.

Common mistakes in the sector

  • 1Hazardous biometrics. Deploying access facial recognition without a framework.
  • 2Confused analysis. Equating video analytics with biometrics, or vice versa.
  • 3Absent transparency. Failing to disclose the use of video/AI.
  • 4GDPR ignored. Forgetting that biometrics is sensitive data.

Practical case

An event organiser considered facial recognition for stadium access. In light of AI Act restrictions and GDPR sensitivity, they opted instead for a nominative ticketing system and conventional checks, which are less intrusive.

Compliance roadmap

  1. 1

    Inventory. Map AI and video use cases.

  2. 2

    Qualify. Distinguish analysis from biometrics.

  3. 3

    Exclude. Prohibiting unauthorised biometrics.

  4. 4

    Inform. Ensure transparency.

  5. 5

    Articulate. Handle biometrics under GDPR.

Frequently asked questions

Generally no, except for biometric identification.

Back to the Sport guideSport & GDPR

Take action on AI Act

Free assessment or a chat with an expert dedicated to sport.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the sport sector secured their compliance with DCO.

See testimonials