S. 1290: Artificial Intelligence and Critical Technology Workforce Framework Act of 2025

S. 1290 would turn NIST into a much more active builder of workforce frameworks for artificial intelligence, cybersecurity, and other critical or emerging technologies. The bill defines a workforce framework as a "common taxonomy and lexicon" built from tasks, knowledge, and skills that can be organized into work roles or competency areas. It also defines "competencies" as "knowledge and skills" and "workforce categories" as high-level groupings of tasks across an organization. In plain English, the bill wants a shared national language for what tech jobs are, what workers need to know, and how people can move into those roles.

The biggest hard deadline is for AI. Within 180 days after enactment, the NIST Director must assess whether more workforce frameworks are needed for additional technologies, with quantum information science given as an example. Then, not later than 540 days after enactment, NIST must develop and publish an Artificial Intelligence workforce framework, including workforce categories, work roles, and competency areas. That AI framework must include professional or employability skills, support and operations roles like finance, law and policy, ethics, privacy, human resources, IT, operational technology, supply chain security, and acquisition or procurement, plus information for people from nontechnical and nontraditional backgrounds.

The bill also tightens how NIST handles cybersecurity. Not later than 180 days after enactment, the Director must report on how NIST will keep reviewing and updating NIST Special Publication 800-181, the NICE Workforce Framework for Cybersecurity, or any successor version. A second set of reports comes 3 years after enactment and then every 3 years after that for a 9-year period. Those reports must explain how the framework is being used, what guidance the NICE program office is giving out, how employers and education providers are using it, whether it is working for people with nontraditional backgrounds, specifically individuals without bachelor's degrees, and what NIST is doing to increase adoption.

A major practical feature is who this is designed to include. NIST must consult with Federal agencies, industry, State, local, Tribal, and territorial governments, nonprofits, labor organizations, research institutions, and academic institutions. It must produce resources in multiple languages. It must also distribute cybersecurity career resources for all age groups, explicitly including K-12 students, postsecondary learners, and adult workers. And every workforce framework covered by the bill must be reviewed at least once every 3 years, with a report to Congress after each review explaining whether updates are needed and what the update plan is. The bill does not provide a funding amount, but it does create a clear schedule and a broader expectation that tech workforce planning should reach beyond four-year degree holders and traditional technical pipelines.