AI Governance for Arkansas Businesses: What Leadership Needs to Decide Before Employees Use AI

In Brief

• Arkansas's main AI governance law, Act 848 of 2025, applies to public entities such as state agencies, counties, cities, school districts and public colleges. It requires them to adopt written AI use policies, train employees and keep a human responsible for final decisions.
• Private Arkansas businesses face no equivalent state mandate today. A broader privacy and AI bill failed in 2025, and the 2026 fiscal session did not take up AI governance. Existing privacy, contract, employment and industry rules, including HIPAA for healthcare, still apply to how businesses use AI.
• Governance is mostly a set of leadership decisions: which tools are approved, what data may never enter them, who reviews outputs, how long data is kept and what vendors must promise. Making those decisions before adoption is far easier than reversing habits afterward.

The Short Answer

AI governance in Arkansas currently means two different things. For public entities, it is a legal requirement under Act 848 to adopt and follow a written AI policy. For private businesses, it is a management responsibility: deciding in advance how employees may use AI, protecting confidential information, reviewing AI-generated work and holding vendors accountable. A short, enforced policy backed by technical controls is more effective than a long one nobody reads.

What Arkansas Law Actually Requires

For Public Entities: Act 848 of 2025

House Bill 1958 became Act 848 when it was signed on April 17, 2025. It amends Arkansas Code section 25-1-128, which already required public entities to maintain technology and cybersecurity policies, to add a policy on artificial intelligence and automated decision tools.

Public entities covered by the law include state departments and agencies, political subdivisions such as counties and municipalities, public school districts and charter schools, institutions of higher education and offices of constitutional officers. Each must have a policy that defines authorized uses of AI and automated decision tools, provides employee training and establishes disciplinary procedures for violations. Commentators summarizing the act note that it also requires a human employee to make final decisions regardless of AI recommendations, and that policies must be available to the public upon request.

Adoption has been uneven. A University of Arkansas Cooperative Extension Service analysis published in May 2026 reported that, of 20 counties selected at random, only one had adopted an AI policy to satisfy Act 848.

At the state executive branch level, the Office of State Technology's AI in Arkansas Safety, Security and Trust Report includes a draft state AI policy. That draft would require agencies to obtain approval before acquiring or implementing AI systems and would make employees, contractors and vendors responsible for reporting suspected misuse.

For Private Businesses: Targeted Laws, Not a Governance Mandate

Arkansas enacted several AI-related laws in 2025 that affect private parties without requiring an AI governance program:

• Act 927 (House Bill 1876) addresses ownership of content generated by generative AI tools, generally assigning ownership to the person who provides the input, provided the output does not infringe existing rights.
• House Bill 1071 expanded the state's publicity rights law to cover the unauthorized commercial use of a person's voice or likeness created with AI.

A more comprehensive measure, Senate Bill 258, the proposed Arkansas Digital Responsibility, Safety, and Trust Act, would have regulated high-risk AI systems and personal data processing. It did not pass in 2025. Arkansas's 2026 legislative session was a fiscal session, which concluded April 29, 2026, without new AI governance legislation.

The practical result: private businesses in Little Rock, Conway or Benton are not required by state law to adopt an AI policy. They remain subject to existing obligations that AI use can trigger, including confidentiality agreements, customer contracts, employment law, the Arkansas Personal Information Protection Act's security requirements and, for healthcare organizations, HIPAA.

This summary is for general information and is not legal advice. Consult counsel about your specific obligations.

Why Governance Matters Without a Mandate

Shadow AI Is Already Present

In most organizations, employees adopted AI before leadership discussed it. Staff use free chatbots to draft emails, summarize documents, write code or analyze spreadsheets. They often paste in customer lists, contracts, financial data or internal plans. The organization may have no agreement with the provider, no control over how long that data is kept and no visibility into what was shared.

Shadow AI is rarely malicious. It reflects real productivity gains. The governance goal is not to stop AI use, but to move it onto approved tools with appropriate protections.

Confidential Information Has New Exit Points

AI tools introduce new ways for sensitive information to leave an organization. Uploaded documents, browser extensions that read page content, meeting assistants that record calls, and AI features within existing software can all transmit data to outside services. Each needs a deliberate decision.

Accountability Does Not Transfer to Software

When an AI tool drafts a contract clause, a customer response or a financial summary, the person and organization that use it remain responsible for its accuracy. AI systems can produce confident, plausible and incorrect output. Policies need to define where human review is required.

Eight Decisions Leadership Should Make

The following decisions form the core of an AI governance program for a small or midsize business. They align with the governance and mapping functions of the NIST AI Risk Management Framework, scaled to organizations without a dedicated risk team.

1. Approved tools. Which AI tools may employees use for work, and under which accounts? Enterprise versions with data-protection commitments are generally preferable to personal accounts.
2. Prohibited data. What information may never be entered into AI tools, or only into specific approved tools? Typical examples include customer personal data, patient information, passwords, unreleased financial results, legal matters and trade secrets.
3. Permissions and access. Which roles may use which AI capabilities? AI assistants connected to email, files and chat can surface any information the user can access, which makes cleaning up overly broad file permissions a prerequisite rather than an afterthought.
4. Human review. Which outputs must be reviewed by a qualified person before use? Customer-facing communications, legal documents, financial reports, hiring decisions and clinical documentation usually qualify.
5. Vendor requirements. What must AI vendors commit to in writing? Common requirements include no training on your data without consent, defined retention periods, data location, breach notification, sub-processor disclosure and deletion at contract end.
6. Retention. How long are prompts, uploaded files, transcripts and outputs kept, and who can access them? Meeting recordings and transcripts in particular may create records your organization would not otherwise keep.
7. Security controls. Which technical measures enforce the policy? Examples include single sign-on and MFA for AI tools, data loss prevention rules, blocking unapproved AI sites on company devices and logging of AI usage.
8. Ownership and review. Who maintains the policy, approves new tools and responds to incidents? How often will the policy be revisited? AI capabilities change quickly enough that annual review is a minimum.

What This Means for Healthcare Practices

Healthcare organizations have stricter obligations. Any AI tool that creates, receives, maintains or transmits protected health information on behalf of a covered entity generally requires a Business Associate Agreement, and the tool belongs in the practice's HIPAA risk analysis. Clinical uses carry additional considerations, including accuracy review of documentation and federal nondiscrimination requirements for clinical decision support tools.

For practices, decisions 2, 4 and 5 above are not optional. Patient information should be confined to approved, contracted tools, clinical outputs should always be reviewed by the responsible clinician and vendor agreements should address PHI specifically.

Rolling Out the Policy

A practical sequence for a Central Arkansas business:

1. Survey staff anonymously about which AI tools they already use and for what.
2. Choose one or two approved tools that meet most needs, and secure appropriate licenses.
3. Draft a policy of one to three pages that answers the eight decisions above.
4. Configure technical controls that support the policy.
5. Train employees with concrete examples of allowed and prohibited uses.
6. Collect feedback after 60 to 90 days and adjust.

Public entities subject to Act 848 can use the same sequence while confirming that their policy contains each element the statute requires. Templates such as the one distributed by the Association of Arkansas Counties may help.

Conclusion

Arkansas has taken a measured approach to AI regulation: clear requirements for government, targeted rules for specific harms and no general mandate for private businesses. That leaves private organizations free to adopt AI, and responsible for doing it carefully. The businesses that benefit most will be those whose leaders made a few clear decisions early about tools, data, review, vendors and security, then enforced them consistently.

Talk to Meem Health

Meem Health helps Arkansas businesses, healthcare practices and public entities draft practical AI use policies, select and configure approved AI tools, clean up data permissions before AI assistants are enabled and implement the security controls that make a policy enforceable. Call or text 501-777-5177 to start the conversation.