EC-Council has released ADG 2.0, the second version of its Adopt, Defend, Govern framework, and is offering the framework and its crosswalks to more than 90 regulations, standards and frameworks free to any government, regulator or standards body. The organization will also assist those bodies in applying ADG 2.0 to their own laws and draft rules, consistent with applicable law.
The announcement comes amid mounting evidence that AI agents are already operating beyond intended limits. In July, OpenAI disclosed that models in an internal cybersecurity evaluation escaped their testing environment and compromised parts of Hugging Face's production infrastructure. In September, Australian Prime Minister Anthony Albanese said an OpenAI agent gained unauthorized access to a public-facing Medicare statistics portal in June. OpenAI has also confirmed its agents accessed U.S. government websites in ways it neither planned nor approved.
Governments remain divided on how to respond. President Donald Trump has said concerns about AI risks are exaggerated. China's Foreign Ministry has said fearmongering, confrontation and vicious competition would hamper sound global AI governance. On Sept. 26, Singapore Foreign Affairs Minister Vivian Balakrishnan urged the United Nations General Assembly to set new multilateral rules and suggested a UN Framework Convention on AI Safeguards.
"The nuclear non-proliferation treaty worked because inspectors could weigh uranium," said Jay Bavisi, founder, chairman and group CEO of EC-Council. "You can't weigh an agent's behavior, and no AI treaty will be signed and ratified in time to protect the systems agents are reaching today. Governments shouldn't have to build governance from a blank page while they wait."
ADG 2.0 replaces the original 12 minimum controls with more than 180 controls in 12 control families, mapped to more than 90 regulations, standards and frameworks, including the NIST AI RMF, ISO/IEC 42001 and the EU AI Act. Regulators can see how a proposed national rule lines up against what other jurisdictions already require. Enterprises can work from one control set and show how it satisfies each rulebook they answer to.
"Most AI governance today is a policy document nobody tests," Bavisi said. "Say what you do, do what you say, and be able to prove both on any given day. That's what a regulator, an insurer, or a board will ask for after the next incident. There will be a next incident."
Controls apply at four points in how an AI system operates—ADMIT, DECIDE, EMIT and COMMIT—with human approval required at defined decision thresholds. Three autonomy levels—assistive, conditional and autonomous—set what a system may do and when a human must review. Each control lists the evidence it must produce, so organizations collect proof while systems run rather than before an audit.
ADG is stewarded by EC-Council's AI Advisory Board of 38 practitioners from organizations such as Salesforce, ServiceNow, Azure, Microsoft, Citi, JPMorgan Chase, NTT DATA, Jio Platforms and BNP Paribas Wealth Management. Members serve in their personal capacity, and organizations are listed for identification only.
The ADG 2.0 framework, crosswalks and AI Readiness Self-Assessment are free to everyone, without registration, at https://www.eccouncil.org/adgframework/. EC-Council, founded in 2001, is a global cybersecurity and AI organization that created the Certified Ethical Hacker program and has certified more than 400,000 professionals across 174 countries.
