What happened
On October 2, 2026, EC-Council released ADG 2.0 (Adopt, Defend, Govern), version 2 of its AI governance framework stewarded by its 35-member AI Advisory Board. It expands the original 12 minimum controls to 180+ controls in 12 control families (720+ requirements) across three pillars (Adopt, Defend, Govern), with runtime governance at four points (ADMIT, DECIDE, EMIT, COMMIT), tiered assistive/conditional/autonomous autonomy levels, defined evidence requirements, a DART implementation method, and crosswalks to 90+ regulations/standards/frameworks including NIST AI RMF, ISO/IEC 42001, EU AI Act, MITRE ATLAS, OWASP LLM Top 10, and the OWASP Agentic Top 10 (with count mapping per source). EC-Council is offering the framework and crosswalks free to governments, regulators and standards bodies.
Why it matters
EC-Council is a recognised professional/certification body (ISO/IEC 17024 accredited, DoD 8140-recognised credentials), and ADG 2.0 is a substantive v2 release of a practitioner frame-ework for AI governance/security that positions itself as an openly available control catalogue and crosswalk hub. It is representative of professional-body frameworks enterprises may adopt to demonstrate AI control coverage across multiple jurisdictions as regulation diverges.
Action needed
Organisations seeking a single control catalogue with multi-standard crosswalks can review ADG 2.0 (free, no registration) as a mapping aid alongside NIST AI RMF / ISO 42001 / EU AI Act implementation, particularly for runtime agent controls and evidence definition.