Arkansas — Insurance AI Bulletin 13-2024 + Prior Authorization Transparency Act + State AI Laws (Acts 159 / 927 / 827 / 977 of 2025) + Federal AI Compliance Profile: AI Compliance Requirements

On 31 July 2024 the Arkansas Insurance Department issued BULLETIN 13-2024, "Use of Artificial Intelligence Systems in Insurance", signed by Commissioner Alan McClain, addressed TO "ALL INSURERS LICENSED TO DO BUSINESS IN ARKANSAS". It reminds every Insurer holding a certificate of authority that decisions or actions impacting consumers made or supported by advanced analytical and computational technologies, including AI Systems, must comply with all applicable insurance laws and regulations — including those addressing unfair trade practices and unfair discrimination — and it sets the Department's expectation that all Insurers authorised to do business in the State "develop, implement, and maintain a written program (an ‘AIS Program’) for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices". The Department expressly recognises the NAIC Principles of Artificial Intelligence adopted in 2020 (fair and ethical use; accountability; compliance with State law; transparency; safe, secure, fair and robust systems) as the guidance underlying those expectations. The AIS Program must be RISK-PROPORTIONATE: controls are to reflect the Insurer's own assessment of the degree and nature of risk posed to consumers, considering (i) the nature of the decisions being made, informed or supported by the AI System, (ii) the type and Degree of Potential Harm to Consumers, (iii) the extent to which humans are involved in the final decision-making process, (iv) the transparency and explainability of outcomes to the impacted consumer, and (v) the extent and scope of reliance on data, Predictive Models and AI Systems from third parties. The AIS Program Guidelines then run to concrete duties: §§ 1.3 and 1.5 vest responsibility with senior management accountable to the board or an appropriate board committee and permit the programme to sit inside or alongside existing ERM, optionally adopting a third-party framework such as the NIST AI Risk Management Framework Version 1.0; §§ 1.6-1.7 require coverage of the whole insurance life cycle (product development and design, marketing, use, underwriting, rating and pricing, case management, claim administration and payment, fraud detection) and the whole AI System life cycle (design, development, validation, implementation, use, on-going monitoring, updating, retirement); § 1.8 extends the programme to AI Systems built by a third-party vendor as well as in-house; and § 1.9 requires processes providing NOTICE to impacted consumers that AI Systems are in use, with access to appropriate levels of information based on the life-cycle phase. Sections 2.0-3.7 add the governance and risk-management detail: documented policies at each life-cycle stage, an internal accountability structure, data practices and accountability procedures (data currency, lineage, quality, integrity, bias analysis and minimisation, suitability), management and oversight of Predictive Models, validation/testing/retesting including evaluation of Model Drift, protection of non-public consumer information, data and record retention, and — for Predictive Models specifically — a narrative description of the model's intended use and outputs. HONEST REGISTER NOTE: the bulletin speaks throughout in the expectation register ("should", "is expected to"); it is guidance issued under existing law, not a rule with its own penalty schedule. Its enforceable edge comes entirely from the statutes it cites, which is where the Arkansas-specific analysis below begins.

Two duties in Bulletin 13-2024 are the ones that actually bite in an Arkansas market conduct action, and both are about EVIDENCE. (1) THIRD-PARTY AI. Section 4.0 requires the AIS Program to address the Insurer's process for acquiring, using or relying on third-party DATA used to develop AI Systems and on AI SYSTEMS developed by a third party: § 4.1 due diligence and the methods the Insurer employs to assess the third party and its data, models or AI Systems; § 4.2 the inclusion, where appropriate and available, of contract terms addressing the third party's obligations (including cooperation with regulators and access to data and models); and § 4.3 the performance of contractual audit rights and other activities confirming the third party's compliance. The practical consequence is that buying a vendor model does not move the legal duty — the Insurer remains answerable for what the model does to an Arkansas consumer. (2) PRODUCTION ON EXAMINATION. The bulletin's opening paragraph states that it "advises Insurers of the type of information and documentation that the Department may request during an investigation or examination of any Insurer regarding its use of such technologies and AI Systems", and Section 4 then enumerates it: AIS Program information (governance and accountability structures, policies and procedures, documentation and record-keeping, and the model validation and testing regime), third-party information (due diligence, contractual terms, audit performance), and — for any specific model or AI System — documentation of compliance with applicable AI Program policies, protocols and procedures; information about the data used in the development and oversight of that model including its SOURCE, PROVENANCE, DATA LINEAGE, quality, integrity, BIAS ANALYSIS AND MINIMISATION, suitability and Data Currency; and documentation pertaining to validation, testing and auditing including evaluation of MODEL DRIFT. An Insurer that cannot produce that record set on request has a market conduct problem irrespective of whether any individual decision was wrong, because the Department's framework for demanding it is statutory (Ark. Code Ann. § 23-63-216(b) and (c)) and independent of the bulletin. HONEST NOTE: the bulletin does not fix a retention period; § 3.6 requires the AIS Program to address "data and record retention" but the duration is left to the Insurer's own risk-proportionate design.

Bulletin 13-2024 states the rating hook in terms that leave no room for a methodology defence: "The requirements of Ark. Code Ann. § 23-67-208 apply regardless of the methodology that the Insurer used to develop rates, rating rules, and rating plans subject to those provisions. That means that an Insurer is responsible for assuring that rates, rating rules, and rating plans that are developed using AI techniques and Predictive Models that rely on data and Machine Learning do not result in excessive, inadequate, or unfairly discriminatory insurance rates." An Arkansas insurer therefore cannot answer a rate-fairness challenge by pointing at the model; the statutory standard attaches to the OUTPUT. THE SCOPE LIMIT IS THE REAL FINDING, and it is invisible from the bulletin alone — it lives in the statute behind the citation. Ark. Code Ann. § 23-67-203 provides that the rating chapter "applies to all kinds of insurance written on risks in this state by any insurers authorized to do business in this state, EXCEPT: (1) Life insurance; (2) Annuities; (3) DISABILITY, INCLUDING ACCIDENT AND HEALTH, INSURANCE; (4) Ocean marine insurance; (5) Reinsurance; (6) Aircraft insurance; (7) Title insurance; (8) Workers’ compensation and employers’ liability insurance" (for which only an enumerated subset applies, including §§ 23-66-206, 23-67-204, 23-67-205, 23-67-208, 23-67-214, 23-67-216, 23-67-218 and 23-67-219); "(9) Motor vehicle service contracts, for so long as the motor vehicle service contract providers’ exposures to their customers are fully insured by an insurer that is authorized to transact property and casualty insurance business in this state; or (10) Surplus lines insurance." So an AI or machine-learning model that sets ACCIDENT AND HEALTH premiums in Arkansas is outside § 23-67-208 entirely. Health-line AI rating exposure runs instead through the Trade Practices Act — Ark. Code Ann. §§ 23-66-201 et seq. and 23-66-206 (unfair discrimination and unfair or deceptive acts) — which is a conduct standard, not a rate-adequacy standard, and carries a different evidentiary shape. THIS IS NOW A THREE-STATE PATTERN worth planning around rather than treating as an Arkansas quirk: Kentucky, Oklahoma and Arkansas each adopted the NAIC bulletin and each has a rating act that does not reach accident and health, so in all three the bulletin's most concrete numerical standard silently stops at the P&C border. Note also that the P&C rating rules themselves (23 CAR Part 200, Department Rule 23) key their own applicability to "insurance described in Arkansas Code §§ 23-67-203 and 23-67-501" — the carve-out propagates into the filing rules, not just the statute.

Arkansas has the filing-and-sole-basis statute that most NAIC-bulletin states lack, and it predates the AI debate by two decades — the Use of Credit Information in Personal Insurance Act. It matters for AI compliance because its definitions are ALGORITHMIC on their face: Ark. Code Ann. § 23-67-404(8) defines "credit score" as "a number or rating that is derived from an ALGORITHM, COMPUTER APPLICATION, MODEL, or other process that is based solely on credit information for the purpose of predicting the future insurance loss exposure of an individual applicant or insured". Two duties follow. (1) MODEL FILING. Under § 23-67-409(a), "Insurers that use credit scores to underwrite or rate risks shall file their scoring models or other scoring processes with the State Insurance Department"; a third party may file on the insurers’ behalf; and "a filing that includes credit scoring shall include LOSS EXPERIENCE JUSTIFYING the use of credit information". Section 23-67-409(b) then protects the filer: "Any proprietary consumer report scoring system or model filed with the Insurance Commissioner under this subchapter shall remain CONFIDENTIAL unless otherwise directed by a court order" — so the trade-secret objection to filing a model is answered by statute, not by negotiation. (2) NO SOLE-BASIS ADVERSE ACTION. Section 23-67-405 forbids an insurer to deny, cancel or nonrenew a policy of personal insurance SOLELY on the basis of credit information without consideration of any other applicable underwriting factor independent of credit information; to base renewal rates SOLELY upon credit information; or to take an adverse action against a consumer solely because he or she lacks a credit card account — each without consideration of another applicable independent factor. "Adverse action" is defined in § 23-67-404(1) as a denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfavourable change in the terms of coverage or amount of any insurance in connection with the underwriting of personal insurance. HONEST SCOPE LIMIT — this is why the statute is not a general Arkansas AI-model-filing law: § 23-67-403 states flatly that "This subchapter applies to PERSONAL INSURANCE and not to commercial insurance or any other type of insurance", and § 23-67-404(9) defines personal insurance exhaustively as "private passenger automobile, homeowners, motorcycle, mobile home owners, noncommercial dwelling fire insurance, noncommercial farm owners, boat, personal watercraft, snowmobile, and recreational vehicle policies". Accident and health is not in that list, and neither is any commercial line. The trigger is also narrow: it is the use of CREDIT information, not the use of AI — a personal-lines model built on telematics, imagery or purchase behaviour rather than credit data is outside the subchapter, however algorithmic it is.

Arkansas has NO statute regulating AI in health-insurance decisions — the bill that would have created one, HB 1297 of 2025 ("CONCERNING ARTIFICIAL INTELLIGENCE, ALGORITHMS, AND OTHER AUTOMATED TECHNOLOGIES; AND TO REGULATE CERTAIN PRACTICES OF HEALTHCARE INSURERS"), which would have barred AI as the sole basis for denying, delaying or modifying healthcare services and given the Commissioner audit and fining powers up to $25,000 per violation, was filed 29 January 2025, amended and engrossed 27 February 2025, and then WITHDRAWN BY ITS AUTHOR on 1 April 2025 without ever reaching a floor vote. Do not record Arkansas as an AI-in-UR state. The binding constraint is instead TECHNOLOGY-NEUTRAL and older, and it is stricter than most AI-specific statutes because it names a licence rather than a process. Ark. Code Ann. § 23-99-1111 divides the prior-authorization workflow in three: (a) the INITIAL REVIEW of information submitted in support of a request "may be conducted by a qualified person employed or contracted by a utilization review entity"; (b) an APPROVAL "may be approved by a qualified person employed or contracted by a utilization review entity"; but (c)(1) "An ADVERSE DETERMINATION regarding a request for prior authorization shall be made by a PHYSICIAN WHO POSSESSES A CURRENT AND UNRESTRICTED LICENSE TO PRACTICE MEDICINE IN THE STATE OF ARKANSAS issued by the Arkansas State Medical Board." An AI system may therefore triage and may approve, but it cannot deny — and the reserved decider must be Arkansas-licensed specifically, not merely licensed somewhere. Section 23-99-1111(c)(2) adds a specialty-match channel on request (same specialty, another appropriate specialty, or a pharmacologist, who in that case need not meet the Arkansas-licence condition), and § 23-99-1111(c)(3) requires the adverse-determination NOTICE itself to carry the name and telephone number of an Arkansas-licensed physician with whom the requesting provider may discuss the treatment plan and clinical basis, reachable within one business day for an urgent service or two for a nonurgent one, with the entity then notifying the provider of the outcome within one or two business days respectively; where the requester is a physician, the reviewing physician must hold a current unrestricted Arkansas licence AND have the same or similar specialty. That is a human contact point that an automated denial pipeline must be able to populate with a real, reachable, correctly-licensed clinician. Section 23-99-1104 layers transparency on top: the utilization review entity must publish all prior-authorization requirements and restrictions on its website, including the list of services requiring prior authorization and any written clinical criteria explained "in clear and ordinary terms", give contracted providers at least 60 DAYS’ written notice before implementing a new or amended requirement, and publish approval/denial STATISTICS categorised by physician specialty, medication or diagnostic test or procedure, medical indication offered as justification, and reason for denial — a dataset that makes a systematically denying model visible from outside.

Arkansas Act 159 of 2025 (HB 1071, eff. Feb 25, 2025) expanded the Frank Broyles Publicity Rights Protection Act (Ark. Code § 4-75-1101 et seq.) to cover AI-generated reproductions of a person's likeness and voice. Do not use a person's AI-simulated image, photograph, or voice for a commercial purpose (advertising, endorsement, AI-generated content sold or used in trade) without that person's consent. Applies to private and public entities. Enforced by civil action — injunctive relief and damages are available to the affected person. Practical effect for businesses: obtain documented consent before using any AI-cloned voice or synthetic likeness of a real, identifiable person in marketing or commercial content.

Arkansas Act 827 of 2025 (HB 1529, eff. Apr 18, 2025) criminalizes the nonconsensual creation/distribution of digitally manipulated sexual imagery depicting an identifiable person (Class A misdemeanor, up to 1 year; escalating to a Class D felony on a subsequent offense). Act 977 of 2025 (HB 1877, eff. Apr 22, 2025) criminalizes AI-generated child sexual abuse material — computer-generated imagery indistinguishable from a real child engaged in sexual conduct. Both bind private individuals and entities. Practical effect: prohibit any product or service capability that could generate nonconsensual sexual deepfakes or CSAM, and ensure content-generation tools include the controls to prevent it.

Arkansas retail and e-commerce companies (including Walmart vendors) must ensure AI systems comply with FTC Act § 5: no deceptive AI pricing algorithms, no dark pattern checkout flows, no AI-generated product claims that are false or misleading. Cite: FTC enforcement against dark patterns generally; FTC v. Amazon.com (filed 2023, settled Sept. 2025 for $2.5B — a UI/UX "dark patterns" case, not an AI-specific one). Arkansas AG may separately enforce under the Arkansas Deceptive Trade Practices Act.

AI scheduling, hiring, and performance management used by Arkansas's major employers (Tyson, Walmart, manufacturing plants) must comply with Title VII, ADA, and ADEA. AI workforce management systems that disproportionately affect workers by race, national origin, disability, or age violate federal employment law. Maintain records of AI employment decisions for EEOC audit readiness. Cite: EEOC v. iTutorGroup (2022); EEOC ADEA/AI Technical Assistance (2023).

FCRA requires specific adverse action reasons when AI drives credit, employment background check, or tenant screening rejections. CFPB Circular 2022-03 prohibits "black box" adverse action notices — reasons must be specific and derived from actual input factors. Document AI decision factor attribution for all adverse action use cases.

Arkansas Act 927 of 2025 (HB 1876, signed Apr 21, 2025; eff. Aug 3, 2025) sets default ownership rules for generative AI. The person who supplies the input/prompt to a generative AI tool owns the resulting content, and the person who provides lawfully obtained training data owns the trained model — provided the input/data does not infringe an existing copyright or other IP right. EXCEPTION: content or models created by an employee within the scope of employment belong to the employer. This is a civil property-rights default rule (no penalty); it can be altered by contract. Practical effect for businesses: review IP-assignment, vendor, and employment agreements so AI-generated work product and trained models vest as intended, and confirm training data is lawfully sourced.

AI systems in Arkansas K-12 schools must comply with COPPA (under-13 parental consent) and FERPA (student education record confidentiality). EdTech AI vendors serving Arkansas schools must have COPPA-compliant data practices. Arkansas also passed the Children's Online Privacy Protection Act of 2023 (pending implementation) — monitor for private-sector impact.

Arkansas General Assembly meets in odd-numbered years (regular session) and special sessions as called. Monitor arkleg.state.ar.us. Arkansas AG office (arkansasag.gov) enforces consumer protection — deceptive AI claims are actionable.