Framework of more than 180 controls maps to more than 90 regulations and standards, and EC-Council will help any public authority apply it
TAMPA, Fla. (Oct. 1, 2026) EC-Council today released ADG 2.0, the second version of its Adopt, Defend, Govern framework, and offered the framework and its crosswalks to more than 90 regulations, standards and frameworks free to any government, regulator or standards body. EC-Council will also help any of them apply ADG 2.0 to their own laws, draft rules and national standards, consistent with applicable law.
AI agents are already acting outside their limits. In July, OpenAI disclosed that models in an internal cybersecurity evaluation escaped their testing environment and compromised parts of Hugging Face’s production infrastructure. In September, Australian Prime Minister Anthony Albanese said an OpenAI agent gained unauthorized access to a public-facing Medicare statistics portal in June. OpenAI has also confirmed its agents accessed U.S. government websites in unexpected ways.
Governments remain split on how to approach AI oversight. Some officials have said concerns about AI risks are exaggerated, while others have called for stronger international coordination. On Sept. 26, Singapore Foreign Affairs Minister Vivian Balakrishnan urged the United Nations General Assembly to set new multilateral rules and suggested a UN Framework Convention on AI Safeguards.
“The nuclear non-proliferation treaty worked because inspectors could weigh uranium,” said Jay Bavisi, founder, chairman and group CEO of EC-Council. “You can’t weigh an agent’s behavior, and no AI treaty will be signed and ratified in time to protect the systems agents are reaching today. Governments shouldn’t have to build governance from a blank page while they wait.”
ADG 2.0 replaces the original 12 minimum controls with more than 180 controls in 12 control families, mapped to more than 90 regulations, standards and frameworks, including the NIST AI RMF, ISO/IEC 42001 and the EU AI Act. Regulators can see how a proposed national rule lines up against what other jurisdictions already require. Enterprises can work from one control set and show how it lines up with each rulebook they answer to.
“Most AI governance today is a policy document nobody tests,” Bavisi said. “Say what you do, do what you say, and be able to prove both on any given day. That’s what a regulator, an insurer, or a board will ask for after the next incident. There will be a next incident.”
Controls apply at four points in how an AI system operates: ADMIT, DECIDE, EMIT, and COMMIT, with human approval required at defined decision thresholds. Three autonomy levels, assistive, conditional, and autonomous, set what a system may do and when a human must review. Each control lists the evidence it must produce, so organizations collect proof while systems run rather than before an audit.
ADG is stewarded by EC-Council’s AI Advisory Board of 38 practitioners from organizations such as Salesforce, ServiceNow, Azure, Microsoft, Citi, JPMorgan Chase, NTT DATA, Jio Platforms and BNP Paribas Wealth Management. Members serve in their personal capacity, and organizations are listed for identification only.
Governments, regulators and standards bodies can request assistance at adg@eccouncil.org. The ADG 2.0 framework, crosswalks, and AI Readiness Self-Assessment are free to everyone, without registration, on EC-Council’s ADG framework page.
About EC-Council
Founded in 2001, EC-Council is a global cybersecurity and AI organization. It created the Certified Ethical Hacker (CEH) program and has certified more than 400,000 professionals across 174 countries. Its credentials are used across government, defense, enterprise, and academia.
As an ISO/IEC 17024 accredited certification body, EC-Council’s credentials are recognized by the U.S. Department of Defense under DoD 8140 and are held by professionals across the U.S. Army, Navy, and Air Force.
The EC-Council ecosystem includes EC-Council, EC-Council University (ECCU), CodeRed, EC-Council Global Services (EGS), EC-Council Academia and AwareX.
Website: www.eccouncil.org
Media Contact: press@eccouncil.org
About the ADG Framework
EC-Council’s Adopt, Defend, Govern (ADG) framework is a practitioner-led operating model for AI governance. Its three pillars connect board-level oversight with operational and technical controls across the AI lifecycle. ADG 2.0 contains more than 180 controls in 12 control families, with crosswalks to more than 90 regulations, standards, and frameworks. It is stewarded by EC-Council’s 38-member AI Advisory Board and supported by readiness assessments and implementation guidance. Each AI Advisory Board member serves in their personal capacity, and organizations are listed purely for identification. The framework, crosswalks, whitepaper, and self-assessment are available openly without registration or licensing requirements.
