Cybersecurity certification body EC-Council on Friday released ADG 2.0, the second version of its Adopt, Defend, Govern framework for AI, and offered the framework and its crosswalks to more than 90 regulations, standards and global frameworks at no cost to any government, regulator or standards body in the world. The organisation said it would also assist officials who reach out, helping them apply ADG 2.0 to their own laws, draft rules and national standards.
What the framework contains
ADG 2.0 replaces the original framework's 12 minimum controls with more than 180 controls across 12 control families. Its crosswalks map those controls against sources including the NIST AI Risk Management Framework, ISO/IEC 42001, the EU AI Act, MITRE ATT&CK and ATLAS, and the OWASP Top 10 lists for LLM applications and agentic AI — letting regulators see how a proposed national rule lines up against what other jurisdictions already require.
The framework adds runtime governance at four checkpoints in how an AI system operates — admit, decide, emit and commit — with human approval required at defined decision thresholds. It also defines three tiers of autonomy (assistive, conditional and autonomous), spells out what evidence each control must produce, and ships a four-step implementation method called DART: discover, analyse, report and transform.
The governance backdrop
The release lands as governments are split on AI governance. The announcement notes President Trump's position that concerns about AI risks are being exaggerated, China's foreign ministry warning that fearmongering would hamper sound governance, and Singapore foreign minister Vivian Balakrishnan's September 26 call at the UN General Assembly for new multilateral rules, including a possible UN framework convention on AI safeguards.
"You can't weigh an agent's behaviour, and no AI treaty will be signed and ratified in time to protect the systems agents are reaching today," said Jay Bavisi, EC-Council's founder, chairman and group CEO, announcing the release. "Governments shouldn't have to build governance from a blank page while they wait."
The framework, crosswalks and an AI readiness self-assessment are available free to everyone without registration.
Sources: EC-Council releases ADG 2.0 — The Tribune
What the framework contains
ADG 2.0 replaces the original framework's 12 minimum controls with more than 180 controls across 12 control families. Its crosswalks map those controls against sources including the NIST AI Risk Management Framework, ISO/IEC 42001, the EU AI Act, MITRE ATT&CK and ATLAS, and the OWASP Top 10 lists for LLM applications and agentic AI — letting regulators see how a proposed national rule lines up against what other jurisdictions already require.
The framework adds runtime governance at four checkpoints in how an AI system operates — admit, decide, emit and commit — with human approval required at defined decision thresholds. It also defines three tiers of autonomy (assistive, conditional and autonomous), spells out what evidence each control must produce, and ships a four-step implementation method called DART: discover, analyse, report and transform.
The governance backdrop
The release lands as governments are split on AI governance. The announcement notes President Trump's position that concerns about AI risks are being exaggerated, China's foreign ministry warning that fearmongering would hamper sound governance, and Singapore foreign minister Vivian Balakrishnan's September 26 call at the UN General Assembly for new multilateral rules, including a possible UN framework convention on AI safeguards.
"You can't weigh an agent's behaviour, and no AI treaty will be signed and ratified in time to protect the systems agents are reaching today," said Jay Bavisi, EC-Council's founder, chairman and group CEO, announcing the release. "Governments shouldn't have to build governance from a blank page while they wait."
The framework, crosswalks and an AI readiness self-assessment are available free to everyone without registration.
Sources: EC-Council releases ADG 2.0 — The Tribune
