(a) As used in this section:(1) “Artificial intelligence” means a machine-based system that can, based on a given set of human-defined objectives, make predictions, recommendations, or decisions influencing a real or virtual environment;(2) “Automated decision tool” means a system or service that uses artificial intelligence and has been specifically developed and marketed, or specifically modified, to make or to be a controlling factor in making consequential decisions;(3) “Employee” means a person employed by a public entity;(4) “Public entity” means an instrumentality funded in whole or in part by taxpayer funds, including without limitation:(A) The Department of Agriculture;(B) The Department of Commerce;(C) The Department of Corrections;(D) The Department of Education;(E) The Department of Energy and Environment;(F) The Department of Finance and Administration;(G) The Department of Health;(H) The Department of Human Services;(I) The Department of Inspector General;(J) The Department of Labor and Licensing;(K) The Department of the Military;(L) The Department of Parks, Heritage, and Tourism;(M) The Department of Public Safety;(N) The Department of Shared Administrative Services;(O) The Department of Veterans Affairs;(P) The office of a constitutional officer;(Q) A political subdivision of the state;(R) A public school district;(S) A public school district board of directors;(T) An open-enrollment public charter school;(U) An institution of higher education;(V) The State Highway Commission;(W) The Arkansas Department of Transportation; or(X) The Arkansas State Game and Fish Commission;(5) “State educational entity” means an entity with an educational purpose that is funded in whole or in part by taxpayer funds that is, including without limitation:(A) A public school district;(B) A public school district board of directors; and(C) An open-enrollment charter school;(6) “State entity” means:(A) The Department of Agriculture;(B) The Department of Commerce;(C) The Department of Corrections;(D) The Department of Education;(E) The Department of Energy and Environment;(F) The Department of Finance and Administration;(G) The Department of Health;(H) The Department of Human Services;(I) The Department of Inspector General;(J) The Department of Labor and Licensing;(K) The Department of the Military;(L) The Department of Parks, Heritage, and Tourism;(M) The Department of Public Safety;(N) The Department of Shared Administrative Services;(O) The Department of Veterans Affairs;(P) The State Highway Commission;(Q) The Arkansas Department of Transportation;(R) The Arkansas State Game and Fish Commission; and(S) An institution of higher education; and(7) “Technology resources” means:(A) The machines, devices, and transmission facilities used in information processing, including computers, word processors, terminals, telephones, cables, software, and related products;(B) The devices used to process information through electronic capture, collection, storage, manipulation, transmission, retrieval, and presentation of information in the form of data, text, voice, or image and includes telecommunications and office automation functions;(C) Any component related to information processing and wired and wireless telecommunications, including data processing and telecommunications hardware, software, services, planning, personnel, facilities, and training;(D) The procedures, equipment, and software that are designed, built, operated, and maintained to collect, record, process, store, retrieve, display, and transmit information, and the associated personnel, including consultants and contractors; and(E) All email accounts issued by a public entity.
(1) “Artificial intelligence” means a machine-based system that can, based on a given set of human-defined objectives, make predictions, recommendations, or decisions influencing a real or virtual environment;
(2) “Automated decision tool” means a system or service that uses artificial intelligence and has been specifically developed and marketed, or specifically modified, to make or to be a controlling factor in making consequential decisions;
(3) “Employee” means a person employed by a public entity;
(4) “Public entity” means an instrumentality funded in whole or in part by taxpayer funds, including without limitation:(A) The Department of Agriculture;(B) The Department of Commerce;(C) The Department of Corrections;(D) The Department of Education;(E) The Department of Energy and Environment;(F) The Department of Finance and Administration;(G) The Department of Health;(H) The Department of Human Services;(I) The Department of Inspector General;(J) The Department of Labor and Licensing;(K) The Department of the Military;(L) The Department of Parks, Heritage, and Tourism;(M) The Department of Public Safety;(N) The Department of Shared Administrative Services;(O) The Department of Veterans Affairs;(P) The office of a constitutional officer;(Q) A political subdivision of the state;(R) A public school district;(S) A public school district board of directors;(T) An open-enrollment public charter school;(U) An institution of higher education;(V) The State Highway Commission;(W) The Arkansas Department of Transportation; or(X) The Arkansas State Game and Fish Commission;
(A) The Department of Agriculture;
(B) The Department of Commerce;
(C) The Department of Corrections;
(D) The Department of Education;
(E) The Department of Energy and Environment;
(F) The Department of Finance and Administration;
(G) The Department of Health;
(H) The Department of Human Services;
(I) The Department of Inspector General;
(J) The Department of Labor and Licensing;
(K) The Department of the Military;
(L) The Department of Parks, Heritage, and Tourism;
(M) The Department of Public Safety;
(N) The Department of Shared Administrative Services;
(O) The Department of Veterans Affairs;
(P) The office of a constitutional officer;
(Q) A political subdivision of the state;
(R) A public school district;
(S) A public school district board of directors;
(T) An open-enrollment public charter school;
(U) An institution of higher education;
(V) The State Highway Commission;
(W) The Arkansas Department of Transportation; or
(X) The Arkansas State Game and Fish Commission;
(5) “State educational entity” means an entity with an educational purpose that is funded in whole or in part by taxpayer funds that is, including without limitation:(A) A public school district;(B) A public school district board of directors; and(C) An open-enrollment charter school;
(A) A public school district;
(B) A public school district board of directors; and
(C) An open-enrollment charter school;
(6) “State entity” means:(A) The Department of Agriculture;(B) The Department of Commerce;(C) The Department of Corrections;(D) The Department of Education;(E) The Department of Energy and Environment;(F) The Department of Finance and Administration;(G) The Department of Health;(H) The Department of Human Services;(I) The Department of Inspector General;(J) The Department of Labor and Licensing;(K) The Department of the Military;(L) The Department of Parks, Heritage, and Tourism;(M) The Department of Public Safety;(N) The Department of Shared Administrative Services;(O) The Department of Veterans Affairs;(P) The State Highway Commission;(Q) The Arkansas Department of Transportation;(R) The Arkansas State Game and Fish Commission; and(S) An institution of higher education; and
(A) The Department of Agriculture;
(B) The Department of Commerce;
(C) The Department of Corrections;
(D) The Department of Education;
(E) The Department of Energy and Environment;
(F) The Department of Finance and Administration;
(G) The Department of Health;
(H) The Department of Human Services;
(I) The Department of Inspector General;
(J) The Department of Labor and Licensing;
(K) The Department of the Military;
(L) The Department of Parks, Heritage, and Tourism;
(M) The Department of Public Safety;
(N) The Department of Shared Administrative Services;
(O) The Department of Veterans Affairs;
(P) The State Highway Commission;
(Q) The Arkansas Department of Transportation;
(R) The Arkansas State Game and Fish Commission; and
(S) An institution of higher education; and
(7) “Technology resources” means:(A) The machines, devices, and transmission facilities used in information processing, including computers, word processors, terminals, telephones, cables, software, and related products;(B) The devices used to process information through electronic capture, collection, storage, manipulation, transmission, retrieval, and presentation of information in the form of data, text, voice, or image and includes telecommunications and office automation functions;(C) Any component related to information processing and wired and wireless telecommunications, including data processing and telecommunications hardware, software, services, planning, personnel, facilities, and training;(D) The procedures, equipment, and software that are designed, built, operated, and maintained to collect, record, process, store, retrieve, display, and transmit information, and the associated personnel, including consultants and contractors; and(E) All email accounts issued by a public entity.
(A) The machines, devices, and transmission facilities used in information processing, including computers, word processors, terminals, telephones, cables, software, and related products;
(B) The devices used to process information through electronic capture, collection, storage, manipulation, transmission, retrieval, and presentation of information in the form of data, text, voice, or image and includes telecommunications and office automation functions;
(C) Any component related to information processing and wired and wireless telecommunications, including data processing and telecommunications hardware, software, services, planning, personnel, facilities, and training;
(D) The procedures, equipment, and software that are designed, built, operated, and maintained to collect, record, process, store, retrieve, display, and transmit information, and the associated personnel, including consultants and contractors; and
(E) All email accounts issued by a public entity.
(b) A public entity shall:(1) Create a technology resources policy that defines the authorized use of technology resources for the public entity;(2) (A) Develop a cybersecurity policy for all technology resources of the public entity based on the standards and guidelines set by the State Cybersecurity Office.(B) Subdivision (b)(2)(A) of this section shall not apply to political subdivisions of the state;(3) Create an artificial intelligence and automated decision tool policy that:(A) Defines the authorized use of artificial intelligence and automated decision tools for the public entity; and(B) Requires an authorized human employee or designee to make any final decision in the course of his or her employment, regardless of what artificial intelligence or automated decision tool the employee or designee recommends; and(4) (A) Develop a training program for all employees of the public entity concerning the technology resources policy, the cybersecurity policy, and the artificial intelligence and automated decision tool policy, including training on the appropriate use of artificial intelligence and automated decision tools in deciding an outcome in the course of an employee's employment.(B) A political subdivision of the state is not required to develop a training program under this section for a cybersecurity policy.
(1) Create a technology resources policy that defines the authorized use of technology resources for the public entity;
(2) (A) Develop a cybersecurity policy for all technology resources of the public entity based on the standards and guidelines set by the State Cybersecurity Office.(B) Subdivision (b)(2)(A) of this section shall not apply to political subdivisions of the state;
(A) Develop a cybersecurity policy for all technology resources of the public entity based on the standards and guidelines set by the State Cybersecurity Office.
(B) Subdivision (b)(2)(A) of this section shall not apply to political subdivisions of the state;
(3) Create an artificial intelligence and automated decision tool policy that:(A) Defines the authorized use of artificial intelligence and automated decision tools for the public entity; and(B) Requires an authorized human employee or designee to make any final decision in the course of his or her employment, regardless of what artificial intelligence or automated decision tool the employee or designee recommends; and
(A) Defines the authorized use of artificial intelligence and automated decision tools for the public entity; and
(B) Requires an authorized human employee or designee to make any final decision in the course of his or her employment, regardless of what artificial intelligence or automated decision tool the employee or designee recommends; and
(4) (A) Develop a training program for all employees of the public entity concerning the technology resources policy, the cybersecurity policy, and the artificial intelligence and automated decision tool policy, including training on the appropriate use of artificial intelligence and automated decision tools in deciding an outcome in the course of an employee's employment.(B) A political subdivision of the state is not required to develop a training program under this section for a cybersecurity policy.
(A) Develop a training program for all employees of the public entity concerning the technology resources policy, the cybersecurity policy, and the artificial intelligence and automated decision tool policy, including training on the appropriate use of artificial intelligence and automated decision tools in deciding an outcome in the course of an employee's employment.
(B) A political subdivision of the state is not required to develop a training program under this section for a cybersecurity policy.
(c) (1) The technology resources policy and artificial intelligence and automated decision tool policy for each state entity shall be available to the public upon request.(2) The Department of Education, in coordination with the State Cybersecurity Office, shall:(A) Develop technology resources and artificial intelligence and automated decision tool policies that shall be used by each type of state educational institution; and(B) Make the policies developed under subdivision (c)(2)(A) of this section available to the public upon request.
(1) The technology resources policy and artificial intelligence and automated decision tool policy for each state entity shall be available to the public upon request.
(2) The Department of Education, in coordination with the State Cybersecurity Office, shall:(A) Develop technology resources and artificial intelligence and automated decision tool policies that shall be used by each type of state educational institution; and(B) Make the policies developed under subdivision (c)(2)(A) of this section available to the public upon request.
(A) Develop technology resources and artificial intelligence and automated decision tool policies that shall be used by each type of state educational institution; and
(B) Make the policies developed under subdivision (c)(2)(A) of this section available to the public upon request.
(d) Each technology resources and artificial intelligence and automated decision tool policy shall include prohibitions on the use of a public entity's technology resources and artificial intelligence and automated decision tools, including without limitation that a public entity's technology resources shall not be used to:(1) Express a personal political opinion to an elected official unless the opinion is:(A) Within the scope of the employee's regular job duties; or(B) Requested by an elected official or public entity;(2) Engage in lobbying an elected official on a personal opinion if the employee is not a registered lobbyist for the public entity;(3) Engage in illegal activities or activities otherwise prohibited by federal law or state law; or(4) Intentionally override or avoid the security and system integrity procedures of the public entity.
(1) Express a personal political opinion to an elected official unless the opinion is:(A) Within the scope of the employee's regular job duties; or(B) Requested by an elected official or public entity;
(A) Within the scope of the employee's regular job duties; or
(B) Requested by an elected official or public entity;
(2) Engage in lobbying an elected official on a personal opinion if the employee is not a registered lobbyist for the public entity;
(3) Engage in illegal activities or activities otherwise prohibited by federal law or state law; or
(4) Intentionally override or avoid the security and system integrity procedures of the public entity.
(e) A public entity shall create a disciplinary procedure for a violation of the public entity's technology resources and artificial intelligence and automated decision tool policy concerning authorized use of technology resources.
(f) (1) Each state entity shall submit a cybersecurity policy for the state entity for approval to the State Cybersecurity Office by October 1 of each even-numbered year.(2) The State Cybersecurity Office shall establish a procedure to review and approve state entity cybersecurity policies.(3) The Department of Education shall:(A) Develop a cybersecurity policy that shall be used by each type of state educational institution;(B) Submit the policies developed under subdivision (f)(3)(A) of this section for approval to the State Cybersecurity Office by October 1 of each even-numbered year; and(C) Coordinate with each state educational institution to implement the cybersecurity policy.
(1) Each state entity shall submit a cybersecurity policy for the state entity for approval to the State Cybersecurity Office by October 1 of each even-numbered year.
(2) The State Cybersecurity Office shall establish a procedure to review and approve state entity cybersecurity policies.
(3) The Department of Education shall:(A) Develop a cybersecurity policy that shall be used by each type of state educational institution;(B) Submit the policies developed under subdivision (f)(3)(A) of this section for approval to the State Cybersecurity Office by October 1 of each even-numbered year; and(C) Coordinate with each state educational institution to implement the cybersecurity policy.
(A) Develop a cybersecurity policy that shall be used by each type of state educational institution;
(B) Submit the policies developed under subdivision (f)(3)(A) of this section for approval to the State Cybersecurity Office by October 1 of each even-numbered year; and
(C) Coordinate with each state educational institution to implement the cybersecurity policy.
(g) A public entity, except for a political subdivision of the state, shall create a disciplinary procedure for a violation of the public entity's cybersecurity policy in consultation with the State Cybersecurity Office that establishes:(1) A disciplinary procedure for a violation of a state entity's cybersecurity policy; and(2) The reporting procedure for suspected violations of the cybersecurity policy.
(1) A disciplinary procedure for a violation of a state entity's cybersecurity policy; and
(2) The reporting procedure for suspected violations of the cybersecurity policy.
(h) All cybersecurity policies developed under this section shall not be deemed open public records under the Freedom of Information Act of 1967, § 25-19-101 et seq.
(i) The disciplinary procedures under subsection (e) of this section shall not apply to employee communications made in compliance with the:(1) Public Employees' Political Freedom Act of 1999, § 21-1-501 et seq.; or(2) Arkansas Whistle-Blower Act, § 21-1-601 et seq.
(1) Public Employees' Political Freedom Act of 1999, § 21-1-501 et seq.; or
(2) Arkansas Whistle-Blower Act, § 21-1-601 et seq.