United States - Arkansas - AI Policy Requirements (Act 848)

Overview

Arkansas HB 1958, enacted as Act 848 on April 17, 2025, establishes the first comprehensive framework for AI governance across Arkansas public entities. Sponsored by Representative S. Meeks and Senator J. English, the legislation responds to the rapid adoption of AI tools in government operations by ensuring responsible and transparent implementation. Unlike private sector AI regulations that focus on consumer protection or anti-discrimination, Arkansas's approach emphasizes public sector accountability, requiring government agencies to maintain human decision-making authority over AI recommendations. The law reflects growing recognition that AI systems increasingly influence government decisions affecting citizens' rights, benefits, and services, necessitating clear governance frameworks. The legislation's unanimous passage—93-0 in the House, 35-0 in the Senate, and 99-0 on final concurrence—demonstrates bipartisan consensus on the importance of AI oversight in government. Governor Sarah Huckabee Sanders signed the bill as part of a broader technology governance package that included HB 1876 on generative AI ownership rights.

Definitions

HB 1958 establishes foundational definitions for Arkansas public sector AI governance. Artificial intelligence means a machine-based system that can make predictions, recommendations, or decisions based on human-defined objectives. This broad definition encompasses traditional rule-based systems, machine learning applications, and generative AI tools used in government operations. Automated decision tool is defined more specifically as a system designed to make or significantly influence consequential decisions—those materially affecting individuals' rights, opportunities, or access to services. This distinction allows agencies to apply heightened scrutiny to AI systems with direct citizen impact while maintaining flexibility for administrative AI applications. Public entity encompasses the full range of Arkansas government: state departments, agencies, boards, commissions, educational institutions (including higher education), and political subdivisions such as counties, cities, and special districts. This comprehensive scope ensures consistent AI governance across all levels of Arkansas government. Technology resources includes hardware, software, data, and network infrastructure, establishing the scope of resources subject to the law's use restrictions.

Governance and Institutional Framework

HB 1958 establishes a decentralized governance model where each public entity bears responsibility for developing and implementing its own AI policy. Rather than creating a central AI oversight agency, the law empowers individual entities to craft policies appropriate to their specific operations while mandating common elements. This approach accommodates the diverse AI applications across state government—from predictive analytics in law enforcement to chatbots in citizen services to automated benefit processing in social services. The law does not establish new enforcement agencies or positions but integrates AI governance into existing management and oversight structures. Agency heads and governing boards bear responsibility for policy development, approval, and enforcement. The Arkansas legislature retains oversight through standard mechanisms including appropriations, audits, and legislative hearings. Public transparency requirements—making policies available upon request—enable citizen oversight and accountability. The law does not prescribe specific approval processes for new AI deployments, leaving procedural details to individual agency policies. This flexibility acknowledges varying agency capacities while ensuring minimum governance standards.

Key Focus Areas

• Mandatory AI Policy Development: Every public entity must create a comprehensive policy governing AI and automated decision tool usage.
• Human Final Decision Authority: Policies must mandate that human employees or designees always make final decisions, regardless of AI recommendations—the law's central safeguard.
• Authorized Use Definitions: Policies must clearly define which AI applications are authorized within each entity.
• Employee Training Programs: Public entities must develop training programs on appropriate AI and automated decision tool use.
• Public Availability: AI policies must be made available to the public upon request, ensuring transparency.
• Prohibited Uses: Technology resources cannot be used for personal political opinions, illegal activities, or circumventing security procedures.
• Consequential Decision Scrutiny: Automated decision tools making or influencing consequential decisions receive heightened policy attention.
• Data Security Integration: AI policies must align with existing data security and privacy requirements.

Implementation Framework

HB 1958 takes effect August 3, 2025, providing approximately three and a half months from enactment for public entities to develop compliant AI policies. Implementation requires each covered entity to inventory existing AI and automated decision tool applications, develop policy frameworks addressing authorized uses, establish human oversight mechanisms, create employee training programs, and prepare for public disclosure requests. Larger agencies with sophisticated AI deployments may require more extensive policy development, while smaller entities with limited AI use can implement proportionate policies. The law does not specify review or approval of policies by any central authority, leaving implementation to agency discretion within statutory requirements. Entities should coordinate with their legal counsel, IT departments, and program managers to ensure policies address all AI applications. Training programs must be developed and rolled out to relevant employees before the effective date. Public entities should establish processes for responding to policy disclosure requests. The law's prohibition on using technology for personal political opinions or security circumvention should be integrated into broader acceptable use policies.

Monitoring and Evaluation

HB 1958 does not establish formal monitoring or evaluation mechanisms at the state level. Compliance assessment occurs through decentralized mechanisms: internal agency oversight, public records requests, legislative audits, and constituent complaints. The public availability requirement creates accountability through transparency—citizens, journalists, and advocacy organizations can review AI policies and identify gaps or concerns. The Arkansas legislature may conduct oversight hearings or request compliance reports through existing authorities. Individual agencies bear responsibility for monitoring their own compliance and updating policies as AI applications evolve. The training requirement creates ongoing monitoring opportunity as agencies assess employee understanding and policy adherence. The law's broad applicability to all public entities means monitoring capacity varies significantly—state agencies may have dedicated compliance resources while smaller political subdivisions may rely on existing staff. No specific reporting deadlines or evaluation metrics are prescribed, suggesting a compliance-focused rather than continuous improvement approach. Future legislative amendments may add monitoring requirements based on initial implementation experience.

Penalties, Liability, and Appeals

HB 1958 does not establish specific penalties for non-compliance, distinguishing it from private sector AI regulations with enforcement mechanisms and civil penalties. Compliance is expected through standard government accountability structures: personnel actions for employees violating policies, political accountability for agency leadership, legislative oversight, and potential litigation. The prohibition on using technology resources for illegal activities reinforces existing criminal law rather than creating new penalties. Citizens harmed by AI-influenced government decisions may have recourse through existing administrative appeal processes, constitutional due process claims, or civil rights litigation depending on the specific harm. The human final decision requirement may affect liability analysis—if agencies can demonstrate human review of AI recommendations, they may have stronger defenses against claims of arbitrary or automated decision-making. The law does not create a private right of action specifically for AI policy violations. State employees who violate AI policies may face disciplinary actions under existing personnel rules. Agency heads may face political consequences for significant compliance failures.

Relationship to Other Instruments

HB 1958 operates alongside Arkansas HB 1876 (Act 927), which addresses ownership of generative AI-created content. Together, these laws represent Arkansas's 2025 AI legislative package. HB 1958's focus on public sector governance complements HB 1876's private sector intellectual property framework. The law interacts with existing Arkansas data privacy and security requirements, requiring AI policies to align with established information governance frameworks. At the federal level, the legislation aligns with Executive Order 14110's direction for federal agencies to implement AI governance, potentially facilitating federal-state coordination on AI initiatives. Arkansas's approach differs from more prescriptive state laws like Colorado SB24-205, which regulates private sector high-risk AI systems with detailed compliance requirements. The human oversight requirement reflects principles in the EU AI Act requiring human review of high-risk AI applications, though Arkansas applies this broadly to all public entity AI rather than specific risk categories. The training requirement aligns with federal guidance on AI literacy for government workers.

International Alignment

Arkansas HB 1958 addresses a domain—public sector AI governance—receiving increasing international attention. The EU AI Act includes specific requirements for AI systems used by public authorities, including transparency obligations and fundamental rights impact assessments. Arkansas's human final decision requirement aligns with the EU's principle of human oversight for high-risk AI applications, though implemented through policy mandates rather than technical requirements. The OECD AI Principles emphasize accountability and transparency in AI governance, which Arkansas addresses through its policy development and public availability requirements. UNESCO's Recommendation on the Ethics of AI calls for human oversight of AI systems affecting individuals' rights, consistent with Arkansas's human decision-making mandate. The Council of Europe's emerging AI Convention addresses governmental AI use, making Arkansas's early state-level framework relevant to transatlantic governance discussions. Canada's federal AI governance framework, including the Directive on Automated Decision-Making, similarly requires human oversight and transparency for government AI systems. Arkansas's approach—setting minimum standards while allowing agency flexibility—resembles regulatory patterns in other federalist systems balancing central guidance with local implementation.

Implementation Timeline

Sources and References