EC-Council has released ADG 2.0, the second version of its Adopt, Defend, Govern framework, and is offering the framework and its crosswalks to more than 90 regulations, standards and frameworks free to any government, regulator or standards body. The organization will also assist governments in applying ADG 2.0 to their own laws, draft rules and national standards, consistent with applicable law. The announcement comes as AI agents have already acted outside their intended limits, with incidents including OpenAI models escaping a testing environment and compromising parts of Hugging Face's production infrastructure, and an OpenAI agent gaining unauthorized access to a public-facing Medicare statistics portal in Australia.
The move addresses a growing governance gap as governments remain divided on AI risks. While some leaders downplay concerns, others, like Singapore's Foreign Affairs Minister Vivian Balakrishnan, have urged the United Nations to set new multilateral rules. EC-Council founder and CEO Jay Bavisi noted that traditional treaty approaches, such as nuclear non-proliferation, rely on physical inspections that are not possible for AI agents. "No AI treaty will be signed and ratified in time to protect the systems agents are reaching today," Bavisi said. "Governments shouldn't have to build governance from a blank page while they wait."
ADG 2.0 replaces the original 12 minimum controls with more than 180 controls across 12 control families, mapped to over 90 regulations, standards and frameworks, including the NIST AI RMF, ISO/IEC 42001 and the EU AI Act. This allows regulators to compare proposed national rules with existing requirements in other jurisdictions, while enterprises can use a single control set to demonstrate compliance with multiple rulebooks. "Most AI governance today is a policy document nobody tests," Bavisi said. "Say what you do, do what you say, and be able to prove both on any given day. That's what a regulator, an insurer, or a board will ask for after the next incident. There will be a next incident."
The controls apply at four operational points—ADMIT, DECIDE, EMIT and COMMIT—with human approval required at defined decision thresholds. Three autonomy levels (assistive, conditional and autonomous) set what a system may do and when a human must review. Each control lists the evidence it must produce, enabling organizations to collect proof continuously rather than just before an audit. The framework is stewarded by EC-Council's AI Advisory Board of 38 practitioners from organizations such as Salesforce, ServiceNow, Microsoft, Citi, JPMorgan Chase and NTT DATA, serving in their personal capacities.
Governments, regulators and standards bodies can request assistance, and the ADG 2.0 framework, crosswalks and AI Readiness Self-Assessment are available free to everyone without registration at https://www.eccouncil.org/adgframework/. EC-Council, founded in 2001, is a global cybersecurity and AI organization known for its Certified Ethical Hacker program and has certified more than 400,000 professionals across 174 countries. Its credentials are recognized by the U.S. Department of Defense under DoD 8140. More information is available at www.eccouncil.org.
