One Club Can Have Three Different AI Risk Models
A player-load model, an injury-support tool and a fan-offer engine may share a data platform, but they should not share an undifferentiated governance process.
| Data zone | Typical purpose | Main decision owner | Principal risk |
|---|---|---|---|
| Performance | Adjust training, tactics or recovery | Coach and performance staff | Bad measurement or over-trust changes preparation |
| Medical and welfare | Support injury assessment, treatment or return to play | Qualified clinical staff | Health harm, confidentiality and possible medical-device regulation |
| Fan and commercial | Recommend content, tickets or merchandise | Product and marketing teams | Intrusive profiling, children’s privacy and unfair targeting |
Define those boundaries before procuring wearables or connecting a model to the club data warehouse. “Performance optimisation” is not a sufficient purpose for collecting every available signal.
Start With the Decision, Not the Sensor
A useful performance question is specific:
- Should tomorrow’s running volume change?
- Which match sequences should an analyst review?
- Is a player’s current workload outside their individual reference range?
- Which tactical pattern recurs under a defined game state?
The model should not silently turn that question into “Will this athlete be injured?” or “Should this player receive a contract?” Each additional purpose changes the evidence, people affected and safeguards required.
Record the measurement chain from device to decision:
- sensor and firmware version;
- sampling rate and units;
- missing-data rules;
- transformations and derived features;
- model and threshold version;
- contextual factors available to staff;
- recommendation, human decision and later outcome.
Football already provides a useful minimum principle. IFAB Law 4 requires wearable electronic performance and tracking equipment used in relevant official competitions to be non-dangerous, while organisers providing EPTS must ensure transmitted data is reliable and accurate. Passing an equipment rule does not prove that a downstream injury or selection model is valid, but unreliable measurement invalidates the analysis before AI enters the picture.
The same discipline applies to consumer-facing coaching, explored separately in AI fitness and performance coaching.
Treat Athlete Health Data as Its Own Domain
The ICO expressly includes information from fitness trackers, medical devices and health-risk inferences within its discussion of special-category health data.
A club or provider therefore needs more than a broad privacy notice. For each purpose, identify:
- an Article 6 lawful basis;
- an Article 9 condition where health or other special-category data is processed;
- controller, joint-controller and processor roles;
- who can view raw and derived information;
- retention and deletion rules;
- the athlete’s routes to access, correction, objection and complaint;
- whether a data-protection impact assessment is required.
Where athletes are workers, consent deserves particular caution. ICO guidance on monitoring workers explains that the power imbalance can make consent inappropriate unless there is genuine choice and no adverse effect from refusal. A mandatory wearable cannot be made voluntary merely by adding a consent screen.
Performance staff also should not automatically receive clinical notes. A useful architecture can expose a constrained status—such as an approved training limitation—without disclosing an entire diagnosis.
Know When Performance Software May Become a Medical Device
A readiness score is not outside health regulation simply because it appears in a sports dashboard. Intended purpose is central.
MHRA guidance states that software and AI intended for a medical purpose may fall within the UK medical-device regime. Its current software and AI medical-device collection covers qualification, classification, technical documentation, safety and post-market responsibilities.
Seek specialist advice where a product is intended to diagnose, prevent or treat injury, or where it directs clinical decisions. Avoid making clinical claims first and asking whether the product is regulated later.
Operationally:
- a model may flag a measurement for clinician review;
- it should not overrule clinical examination;
- uncertainty and missing data should be visible;
- model changes should be assessed before use;
- adverse outcomes and near misses should be recorded;
- return-to-play authority should remain explicit.
Selection and Contract Decisions Need Real Human Judgement
The DUAA widened the circumstances in which significant solely automated decisions using ordinary personal data may be made, but safeguards remain, and restrictions around special-category data are stricter. The ICO’s detailed post-DUAA guidance was still being finalised on 31 July 2026.
For current implementation detail, see automated decisions and meaningful human review.
A coach or recruitment lead is not meaningfully involved if they see only a composite score, lack time to inspect its basis or are expected to accept it. For selection, contract, scholarship or release decisions, reviewers should have:
- the underlying observations and known data gaps;
- authority to depart from the recommendation;
- relevant sporting expertise;
- a way to consider context the model does not contain;
- a recorded rationale;
- a route for the affected person to raise an error.
Test outcomes across relevant groups and roles. Aggregate accuracy can conceal systematic under-measurement of a position, age group, disability or body type. Where employment or service decisions are involved, the Equality Act 2010 also needs case-specific assessment.
For EU operations, another boundary matters: the EU AI Act prohibits emotion recognition in workplaces except for medical or safety reasons. The Commission’s current AI Act guidance confirms that position. Do not rebrand speculative facial or vocal emotion inference as a performance metric.
Fan Personalisation Is a Separate Product
A fan-content recommender can be useful without assembling a permanent behavioural dossier.
Separate:
- service personalisation, such as preferred team or accessibility settings;
- editorial recommendations;
- direct marketing and targeted offers;
- location or in-stadium tracking;
- loyalty scoring;
- predictions about spending or vulnerability.
The ICO’s updated direct-marketing guidance requires transparent collection and respect for people’s preferences; individuals have an absolute right to object to direct marketing. PECR also applies to relevant electronic marketing, cookies and similar technologies.
If an app is likely to be accessed by children, the Children’s Code calls for best interests, high-privacy defaults, minimisation and careful profiling. A service is not outside the code merely because its stated target audience is adult supporters.
For UK organisations serving EU users, Article 50 transparency rules apply from 2 August 2026 in relevant cases. AI chat interactions and qualifying synthetic or manipulated fan content need the role-specific treatment explained in the EU AI Act transparency guide.
Decision Rights by Use Case
| Use case | AI may do | Human must retain |
|---|---|---|
| Training-load support | Calculate trends and flag threshold breaches | Interpret context and approve training changes |
| Tactical review | Retrieve and cluster relevant sequences | Decide tactics and communicate them |
| Injury support | Surface anomalies and supporting evidence | Diagnose, treat and decide return to play |
| Recruitment | Organise evidence against defined criteria | Assess context and make the consequential decision |
| Fan content | Rank items within declared preferences | Set editorial and safeguarding policy |
| Marketing offers | Select eligible audiences within approved rules | Approve purposes, claims, exclusions and complaint handling |
The Rollout Gates
| Gate | Pass condition |
|---|---|
| Purpose | Each data field maps to a declared decision and owner |
| Data rights | Lawful basis, any Article 9 condition, notices, contracts and retention are documented |
| Measurement | Sensor units, missingness, latency and version lineage are tested |
| Model quality | Performance beats the agreed non-AI or current-process baseline on frozen data |
| Group review | Error, missingness and outcome measures are reviewed by relevant group and playing role |
| Human authority | Reviewers can inspect, disagree, change the result and record why |
| Clinical boundary | Intended purpose and any MHRA implications are signed off before medical use |
| Fan controls | Opt-outs work, children receive appropriate defaults and targeting rules are testable |
| Security | Athlete and fan data are segregated by role; exports and access are logged |
| Live monitoring | Overrides, adverse events, complaints and drift trigger a named review process |
Do not scale because staff enjoy the dashboard. Scale when a defined decision improves without weakening athlete welfare, confidentiality or fan control.
Create a decision record for every material performance or welfare recommendation. It should identify the athlete, purpose, source window, missing data, model and threshold, person who reviewed it, action taken and reason for any override. Review a representative sample regularly with coaches, clinicians and athlete representatives. That record separates a useful prompt from an unexplained instruction, reveals when the same sensor fault affects several decisions and gives the club evidence when a player questions a recommendation. Delete or restrict records according to the documented purpose rather than retaining an indefinite biometric history “just in case”.
Supplier Questions Before Signing
Ask whether the vendor can:
- export raw, derived and decision records in usable form;
- separate club data from shared model training;
- document sensor and model-version changes;
- show validation at the intended sporting level and population;
- delete an athlete or fan’s data across backups and subprocessors;
- restrict performance staff from clinical data;
- support correction and challenge workflows;
- operate if connectivity fails;
- disclose any medical-device status and intended purpose;
- explain how children, EU users and direct marketing are handled.
The competitive advantage is not collecting the most biometric data. It is knowing which signal supports which decision, who is allowed to act and when the system must defer to sporting or clinical judgement.
