EC-Council Releases ADG 2.0 and Offers Its AI Governance Crosswalks Free to Every Government, Regulator and Standards Body as Nations Split on AI Rules

With autonomous no global treaty in sight, EC-Council will assist any public authority that asks to map ADG 2.0's 180+ controls to its own laws and standards

TAMPA, Fla., Oct. 1, 2026 /PRNewswire/ -- EC-Council today released ADG 2.0, the second version of its Adopt, Defend, Govern framework, and offered the framework and its crosswalks to more than 90 regulations, standards and global frameworks at no cost to any government, regulator or standards body in the world. EC-Council will also assist any of those that reach out, helping officials apply ADG 2.0 to their own laws, draft rules and national standards, consistent with applicable law.

The offer comes as governments split on how to govern AI. President Trump has said concerns about AI risks are being exaggerated. China's Foreign Ministry said that fearmongering, confrontation and vicious competition would hamper sound global AI governance and on September 26, Singapore's Foreign Affairs Minister Vivian Balakrishnan urged the UN General Assembly to establish new multilateral rules, suggesting a UN Framework Convention on AI Safeguards.

Meanwhile, autonomous agents are already crossing boundaries. In July, OpenAI disclosed that models undergoing an internal cybersecurity evaluation had circumvented their testing environment and compromised parts of Hugging Face's production infrastructure. Last week, Australia's Prime Minister said an OpenAI agent had gained unauthorized access to a public facing Medicare statistics portal in June. OpenAI also confirmed its agents had accessed U.S. government websites in ways it neither planned nor approved and paused training of its latest models. Separately, an independent research lab also reported a failed attempt against a Department of Education website.

"The nuclear non-proliferation treaty worked because inspectors could weigh uranium," said Jay Bavisi, Founder, Chairman and Group CEO, EC-Council. "You can't weigh an agent's behavior, and no AI treaty will be signed and ratified in time to protect the systems agents are reaching today. Governments shouldn't have to build governance from a blank page while they wait. ADG 2.0 is open, it's already mapped to the rules they're working with, and we'll sit down with any government, regulator or standards body that wants help putting it to work."

ADG 2.0 replaces the original 12 minimum controls with more than 180 controls in 12 control families, mapped to more than 90 regulations, standards and frameworks, including NIST AI RMF, ISO/IEC 42001 and the EU AI Act. For a regulator, the crosswalks show how a proposed national rule lines up against what other jurisdictions already require. For an enterprise, they mean working on one control set and showing how that work satisfies every rulebook it answers to, even as those rulebooks diverge.

"Most AI governance today is a policy document nobody tests," Bavisi said. "ADG 2.0 asks for something harder. Say what you do, do what you say, and be able to prove both on any given day. That's what a regulator, an insurer, or a board will ask for after the next incident. There will be a next incident."

ADG is stewarded by EC-Council's 35-member AI Advisory Board, comprising practitioners who build, secure, transform, and govern AI across some of the world's leading organizations such as Salesforce, ServiceNow, Azure, Microsoft, Citi, JPMorgan Chase, NTT DATA, Jio Platforms, BNP Paribas Wealth Management and others.

The framework includes:

• 180+ controls in 12 control families. One catalogue covering what needs to be governed across the AI lifecycle, from design and data through runtime monitoring, incident response and third-party risk.
• Mappings to 90+ regulations, standards and frameworks. Crosswalks to sources including NIST AI RMF, ISO/IEC 42001, the EU AI Act, MITRE ATT&CK, MITRE ATLAS, the OWASP Top 10 for LLM Applications and the OWASP Agentic Top 10.
• Runtime governance. Controls at four points in how an AI system operates, ADMIT, DECIDE, EMIT and COMMIT, with human approval required at defined decision thresholds.
• Tiered autonomy. Assistive, Conditional and Autonomous levels set out what an AI system may do at each level, when a human must review, and what evidence must be kept.
• Defined evidence requirements. Each control specifies the evidence it must produce, so organizations collect it while systems run rather than assemble it before an audit.
• DART implementation method. Discover, Analyze, Report, and Transform takes an organization from finding governance gaps to closing them.

Governments, regulators and standards bodies can request assistance at [email protected]

The ADG 2.0 framework, crosswalks and AI Readiness Self-Assessment are available free to everyone, without registration, at https://www.eccouncil.org/adgframework/

About EC-Council

Founded in 2001, EC-Council is a global cybersecurity and AI organization. It created the Certified Ethical Hacker (CEH) program and has certified more than 400,000 professionals across 174 countries. Its credentials are used across government, defense, enterprise and academia.

As an ISO/IEC 17024 accredited certification body, EC-Council's credentials are recognized by the U.S. Department of Defense under DoD 8140 and are held by professionals across the U.S. Army, Navy and Air Force.

The EC-Council ecosystem includes EC-Council, EC-Council University (ECCU), CodeRed, EC-Council Global Services (EGS), EC-Council Academia and AwareX.

Website: www.eccouncil.org 

Contact: [email protected] 

About the ADG Framework

EC-Council's Adopt, Defend, Govern (ADG) framework is a practitioner-led operating model for AI governance. Its three pillars connect board level oversight with operational and technical controls across the AI lifecycle. ADG 2.0 contains more than 180 controls in 12 control families, with crosswalks to more than 90 regulations, standards and frameworks. It is stewarded by EC-Council's 38 member AI Advisory Board and supported by readiness assessments and implementation guidance. Each AI Advisory board member serves in their personal capacity, and organizations are listed purely for identification. The framework, crosswalks, whitepaper and self-assessment are available openly without registration or licensing requirements.

SOURCE EC-Council