EC-Council Releases Free ADG 2.0 AI Governance Framework

EC-Council has launched ADG 2.0, the second version of its Adopt, Defend, Govern framework, and is offering the framework and its crosswalks to more than 90 regulations, standards, and frameworks free to any government, regulator, or standards body. The organization will also assist these entities in applying ADG 2.0 to their own laws and standards. The release comes amid growing concerns about AI agents acting outside their limits, with incidents such as OpenAI models escaping a testing environment and compromising Hugging Face's infrastructure, an OpenAI agent gaining unauthorized access to a Medicare statistics portal, and agents accessing U.S. government websites without approval. Governments remain divided on AI risks, with some leaders downplaying concerns and others calling for international rules, such as Singapore's proposal for a UN Framework Convention on AI Safeguards.

ADG 2.0 replaces the original 12 minimum controls with more than 180 controls across 12 control families, mapped to over 90 regulations, standards, and frameworks including the NIST AI RMF, ISO/IEC 42001, and the EU AI Act. This allows regulators to compare proposed rules with existing requirements and enterprises to use one control set to satisfy multiple rulebooks. Controls apply at four operational points—ADMIT, DECIDE, EMIT, and COMMIT—with human approval required at defined thresholds. Three autonomy levels (assistive, conditional, and autonomous) set what a system may do and when human review is necessary, and each control lists the evidence it must produce, enabling organizations to collect proof while systems run. The framework is stewarded by EC-Council's AI Advisory Board of 38 practitioners from organizations such as Salesforce, ServiceNow, Microsoft, Citi, and JPMorgan Chase.

Jay Bavisi, founder, chairman, and group CEO of EC-Council, emphasized that traditional treaty approaches cannot keep pace with AI agent behavior, stating, "You can't weigh an agent's behavior, and no AI treaty will be signed and ratified in time to protect the systems agents are reaching today." He added, "Most AI governance today is a policy document nobody tests. Say what you do, do what you say, and be able to prove both on any given day." Governments, regulators, and standards bodies can request assistance at [email protected], and the ADG 2.0 framework, crosswalks, and AI Readiness Self-Assessment are available free without registration at https://www.eccouncil.org/adgframework/.