What happened
On 1 October 2026, certification body EC-Council released ADG 2.0, the second version of its Adopt, Defend, Govern framework, replacing the original 12 minimum controls with more than 180 controls across 12 control families mapped to 90+ regulations, standards and frameworks (including NIST AI RMF, ISO/IEC 42001, EU AI Act, MITRE ATLAS, OWASP LLM and Agentic Top 10s). It adds runtime governance at four decision points (ADMIT/DECIDE/EMIT/COMMIT), tiered autonomy levels, defined evidence requirements per control, and a DART implementation method. EC-Council is offering the framework and crosswalks free to any government, regulator or standards body, and will assist in mapping it to national rules.
Why it matters
ADG 2.0 is a substantive, dated control-catalogue release (180+ testable controls with evidence requirements) rather than a blog framework. Because it ships pre-built crosswalks to the major AI security/risk frameworks, it is directly usable as a harmonization layer for organizations that must satisfy NIST/ISO/EU simultaneously, and governments and standards bodies are being handed it as a template — meaning it may feed into national rule-writing even though it lacks standards-body backing.
Action needed
Teams managing multi-framework AI governance can evaluate ADG 2.0's control families and crosswalks as a mapping/normalization aid while awaiting the ISO/IEC 27090 series; standards bodies should be aware national regulators may adopt ADG-derived controls.