ARP is layer 2. The reason being is that a broadcast is sent on layer 2 (data link layer) and ARP will normally not traverse to layer 3 (network layer). However it can provide extra features to the layer 3 protocol.
The truth is that not all protocols fit the OSI model exactly, because after all it's just a model. If you really want to push it into a spot I'd say ARP is a layer 2.5 protocol. It fits layer 2, but doesn't fit layer 3 completely.
The same discussion is often held about ICMP and where it fits in: layer 3 or layer 4.
A good explanation on these exceptions is:
Normally, a protocol from layer N+1 is encapsulated with the header of
the protocol from Layer N, but protocols like arp, stp, cdp, icmp and igmp
are exceptions because are encapsulated with a header of a protocol
from the same layer.