WORKFLOW AUTOMATION
The agent reads an invoice, checks policy, updates the CRM, and triggers an approval.
Who controls its authority before it acts?
- authority
- tool permissions
- approval gates
- evidence
Sheet 00 / 05From AI Governance on paperto AI Governance in operation:one control set, 90+ Authoritative Sources.
Adopt it. Defend it. Govern it.
ADG is EC-Council's open AI governance framework for the agentic era. 12 control families, 180+ controls, 720+ requirements, mapped to 90 standards and regulations.
Mapped to
90
standards and regulations
- NIST AI RMF140controls mapped
- EU AI Act139controls mapped
- OECD AI Principles138controls mapped
- ISO/IEC 42001135controls mapped
- CSA AI Controls Matrix95controls mapped
- Google SAIF77controls mapped
- MITRE ATLAS72controls mapped
- OWASP LLM Top 1068controls mapped
- ISO/IEC 2700156controls mapped
- GDPR18controls mapped
Sheet 01 / 05Operating model
What is ADG?
Not a rulebook.An operating model.
An AI governance framework is the set of policies, controls, and accountability chains that decide how an organization builds, ships, and watches its AI: who signs off before a model goes live, what gets checked before and after, and how any of it is proven to a regulator or the board. ADG makes that continuous: controls run and evidence accumulates on every run, not once a year.
Policy
Who may approve a use case, and who is accountable when the system acts.
Controls
12 control families, 180+ controls, each with the requirements that prove it.
Evidence
Proof that accumulates at every stage, so an audit is a review, not an investigation.
Control families
12
Library controls
180+
Standards & regulations mapped
90
90 in the crosswalk
Open framework · no registration
Free
Sheet 02 / 05Four moments
Why does it matter?
Every agent will acton your behalf.
Most organizations already run agents they cannot list, owned by people they cannot name. Each one reads, decides, and acts. The question is never whether it can. It is who controls it before it does.
CUSTOMER ADVISORY
The agent advises a customer, draws on sensitive context, and speaks for your organization.
Who defines the boundary of what it may say or do?
- decision boundaries
- data access
- escalation
- assurance
SOFTWARE ENGINEERING
The agent writes code, tests changes, and prepares systems for release.
Who governs access, release gates, and accountability?
- access control
- testing gates
- release approval
- traceability
MARKETING & CONTENT OPERATIONS
The agent creates, reviews, and prepares business content for publication.
Who owns the claims, approvals, and evidence behind every output?
- content boundaries
- approval flow
- provenance
- review evidence
01 / 04
Governance is not the same as security. ADG does not make you choose.
Adopt and Govern set the policy. Defend enforces it. Govern proves it. One operating model, one body of evidence.
Three lines. One evidence base.
ADG works in tandem. The first, second and third lines are roles, not silos: each one reads and writes the same evidence repository, so nothing is re-done, nothing is reconstructed, and the board sees one continuous record instead of three reports that disagree.
| Line | Who | Activities | Inputs | Outputs |
|---|---|---|---|---|
| 1st · Own the risk | Product, engineering, AI teams | Build, deploy and operate agents; run the controls | Use-case intake, policies, the control library | Control evidence, runtime logs, incident reports |
| 2nd · Challenge the risk | Risk, compliance, security | Set policy, monitor, test, red-team, advise | 1st-line evidence, the regulatory crosswalk | Findings, exceptions, attestations |
| 3rd · Assure the risk | Internal audit | Independent assurance to the board | 1st + 2nd line evidence, same repository | Audit opinion, board evidence pack |
| All three lines write to and read from one repository. Evidence is generated on every run, not reconstructed at audit time. | ||||
Sheet 03 / 05Control set
What do we cover in depth?
12 families.180+ controls.
Three pillars, one control set. Adopt decides what may run. Defend keeps it inside its envelope at runtime. Govern proves both to the people who ask.
ADOPT
Decides what may run.
- Design & Requirements6
- Data19
- Build & Integration29
- Deployment & Change7
DEFEND
Keeps it inside its envelope at runtime.
- Evaluation & Red Teaming21
- Runtime Defense & Monitoring25
- Incident Response & Forensics11
- Third-Party & Supply Chain7
GOVERN
Proves both to the people who ask.
- Accountability & Roles9
- Inventory & Risk5
- Transparency & Interested Parties16
- Oversight & Review23
| Family | Controls | Pillar |
|---|---|---|
| Design & Requirements | 6 | Adopt |
| Data | 19 | Adopt |
| Build & Integration | 29 | Adopt |
| Deployment & Change | 7 | Adopt |
| Evaluation & Red Teaming | 21 | Defend |
| Runtime Defense & Monitoring | 25 | Defend |
| Incident Response & Forensics | 11 | Defend |
| Third-Party & Supply Chain | 7 | Defend |
| Accountability & Roles | 9 | Govern |
| Inventory & Risk | 5 | Govern |
| Transparency & Interested Parties | 16 | Govern |
| Oversight & Review | 23 | Govern |
| 12 families | 180+ | 3 pillars |
Sheet 04 / 05Crosswalk
Which standards?
Evidence once.Answer many.
Regulators, auditors, and security teams ask the same questions in different dialects. ADG answers once: 180+ controls crosswalked to 90 standards, regulations, and threat catalogs across six regions.
90
standards & regulations, one control set
Figure beside each name = ADG controls mapped · underlined = well-known standard · 90 entries across six regions
Global30 entries
- NIST AI RMF140
- OECD AI Principles138
- ISO/IEC 42001135
- CSA AI Controls Matrix (AICM) v1.1.195
- AIUC-192
- Google SAIF77
- MITRE ATLAS72
- OWASP Top 10 for LLM Applications 202568
- ISO/IEC 27001:202256
- IBM AI Risk Atlas45
- ISO/IEC DIS 42005:202431
- ISO/IEC 38507:202231
- Microsoft Responsible AI Standard v228
- NIST AI 600-1 (Generative AI Profile)25
- NIST SP 800-218A (SSDF Generative AI Extension)22
- OWASP Top 10 for Agentic Applications 202622
- AWS & Azure AI Security Baselines19
- MCSB v2—Artificial Intelligence Security18
- ISO/IEC 23894:2023 (AI Risk Management)15
- ISO/IEC 5338:2023 (AI System Life Cycle Processes)12
- OpenAI & Anthropic Security Guidelines12
- ISO/IEC TS 25058:2024 (Quality Evaluation of AI Systems)9
- Responsible AI Institute—TrustX8
- ISO/IEC 38505 Series (Governance of Data)8
- ISO/IEC TR 24027:2021 (Bias in AI Systems & AI-Aided Decision Making)7
- ISO/IEC 23053:2022 (Framework for AI Systems Using ML)6
- ISO/IEC TS 8200:2024 (Controllability of Automated AI Systems)4
- ISO/IEC TR 5469:2024 (Functional Safety and AI Systems)2
- C2PA / IEEE Content Provenance & Authenticity Standard2
- ISO/IEC 24029 Series (Robustness of Neural Networks)1
United States24 entries
- NCSC (UK) & CISA/NSA/FBI Joint Guidelines for Secure AI System Development20
- New York RAISE Act13
- FTC AI & Automated Decision-Making Guidance12
- OMB Federal AI Governance Guidance (M-24-10 / M-25-21)12
- CCPA Automated Decision-Making Technology (ADMT) Regulations10
- Colorado SB 189 (AI ADMT Transparency Act)9
- California SB 53 (Transparency in Frontier AI Act)9
- California AB 2013 (GenAI Training Data Transparency Act)8
- FDA AI/ML Medical Device Mandates7
- NIST AI 100-2 (Adversarial Machine Learning: Taxonomy & Terminology of Attacks and Mitigations)7
- Texas Responsible AI Governance Act (TRAIGA)7
- TAKE IT DOWN Act7
- EEOC Title VII AI Guidance6
- Illinois HB 3773 (Human Rights Act AI Employment Amendments)5
- Future of AI Innovation Act & Preemption Drafts (Proposed)5
- EO 14365 (Ensuring a National Policy Framework for AI)5
- EO 14179 (Removing Barriers to American AI Leadership)5
- Washington My Health My Data Act4
- Washington HB 2225 (AI Companion Chatbot Regulations)4
- SEC Predictive Data Analytics (PDA) Proposed Rule4
- Washington EO 24-01 (GenAI State Procurement)3
- NYC Local Law 144 (Automated Employment Decision Tools)3
- Utah Artificial Intelligence Policy Act (SB 149)3
- California SB 942 (California AI Transparency Act)2
Asia-Pacific19 entries
- MAS Guidelines on AI Risk Management56
- IMDA Model AI Governance Framework (2nd Edition)54
- RBI FREE-AI43
- Malaysia AIGE33
- ASEAN Guide on AI Governance and Ethics33
- Australia Voluntary AI Safety Standard26
- India DPDP Rules 202525
- Australia Mandatory AI Guardrails (Proposed, High-Risk Settings)25
- India DPDP Act 202320
- Malaysia PDPA20
- Singapore PDPA20
- China Interim Measures for Generative AI Services15
- India IT Rules 2026 (SGI / Deepfake Amendment)15
- Malaysia AI Technology Action Plan 2026–203015
- IMDA Model AI Governance Framework for Agentic AI13
- South Korea AI Basic Act (Framework Act on AI Development & Trust)9
- India AI Governance Guidelines (IndiaAI Mission)5
- Malaysia AI in Financial Sector (BNM Discussion Paper)4
- IMDA Model AI Governance Framework for Generative AI3
Middle East8 entries
- SDAIA AI Ethics Principles33
- UAE Charter for AI33
- UAE DIFC Data Protection Law No. 5 of 202024
- UAE DIFC Data Protection Regulation 1023
- UAE PDPL23
- Saudi PDPL19
- UAE Cybercrime Law & Sectoral AI/Model-Risk Guidance (CBUAE/DFSA/FSRA)5
- SDAIA Generative AI Guidelines2
Europe7 entries
- EU AI Act139
- GDPR (EU) 2016/67918
- UK AI Security Institute (AISI)—Frontier AI Safety Evaluation Framework16
- UK AI Regulatory Framework (UK GDPR/DUAA, ICO, Sector Regulators)12
- Council of Europe Framework Convention on AI (CETS No. 225)10
- BSI AIC4 (AI Cloud Compliance Criteria Catalogue)9
- ENISA AI Threat Landscape & Securing Machine Learning Algorithms8
Other2 entries
- Brazil AI Bill (PL 2338/2023)14
- African Union Continental AI Strategy13
Sheet 05 / 05Two ways in
Where do you start?
Start whereyou are.
Two ways in, depending on who you are. Both take minutes, and both hand you something you can act on today.
Assess Your Organization
CISO · CIO · risk · board
Find out where you stand.
You already run agents. The assessment benchmarks your organization against all 12 families, scores each one, and hands you a 30/60/90-day roadmap with named owners. Board-grade, not a slide deck.
Start Now →For companies: 12 families scored, a 30/60/90-day roadmap.
Assess Your Skills
Security · AI · engineering · audit
Prove you can govern an agent.
Pick a pillar. Just 10 minutes, real scenarios, no registration wall. Pass it, and you earn the ADG pillar badge you can put next to your name today.
Start Now →For you: 10 minutes, one pillar, a badge with your name on it.
Need a funded roadmap, not just a list of concerns?
- 01DISCOVERCurrent-state map + stakeholder register
- 02ANALYZEAutomation candidates + ADG gap analysis
- 03REPORTFindings across people, process, technology, and data
- 04TRANSFORMFunded transformation roadmap
Talk to the ADG team →
Scope an engagement: Discover → Analyze → Report → Transform.
Appendix · FAQ8 questions
Questionspeople actuallyask.
What is an AI governance framework?
An AI governance framework is often mistaken for a rulebook that is consulted only after an incident. In practice, it is the set of policies, controls, and accountability chains that determine how an organization builds, ships, and monitors its AI systems: who signs off before a model goes live, what must be checked before and after deployment, and how compliance is demonstrated to a regulator or the board. Because AI evolves rapidly, an effective AI governance framework must be a flexible, living document focused on robust implementation rather than compliance formalities.
What is ADG, and how is it different from other AI governance frameworks?
ADG (Adopt, Defend, Govern) is a free, open AI governance framework developed by EC-Council in collaboration with its AI Advisory Board of leaders from around the world. Many AI governance frameworks focus primarily on policy. ADG also includes a dedicated Defend pillar for the technical side of AI security, so governance and security teams work from the same evidence instead of running two disconnected programs.
Is AI governance the same thing as AI security?
Not quite, although the two terms are often used interchangeably. AI governance is the policy side: it determines who may approve a use case and how that use case is audited. AI security is the technical side: it defends against threats specific to AI, such as prompt injection and model extraction. ADG does not make you choose between them. Adopt and Govern set the policy, Defend enforces it, and Govern proves it. Together, they form a single operating model rather than two teams working in isolation.
Which standards does ADG's AI governance framework map to?
ADG's 180+ controls are crosswalked to 90 standards, regulations, and threat catalogs, including the NIST AI Risk Management Framework (AI RMF), ISO/IEC 42001, and the EU AI Act. New national and sector regulations will be added as they emerge. As a result, audit and compliance teams work from one control set instead of maintaining a separate compliance program for each standard.
Who is this AI governance framework built for?
ADG is built for three audiences:
- • Students and new practitioners learning what AI governance looks like in practice
- • Security and AI leaders accountable for implementing responsible AI
- • Executives and board members, such as chief information security officers (CISOs) and chief information officers (CIOs), who drive corporate strategy and risk management and need audit-grade documentation and evidence
How do I start implementing AI governance in my organization?
Start with Assess Your Organization, which benchmarks your organization against ADG's 12 control families and provides a 30/60/90-day roadmap to work from.
Who maintains the ADG AI governance framework?
EC-Council Global Services leads the framework, supported by a 38-member AI Advisory Board of CISOs, CIOs, and AI engineering leaders from organizations such as Microsoft, Salesforce, JPMorgan Chase, and Citi. Every version is published openly (currently v2.0), and community feedback shapes each new release.
Is ADG free to use?
Yes. ADG is free to use; it is not a free trial. As an open AI governance framework, all of its components are free to access and implement: the 12 control families and 180+ controls, the regulatory crosswalks, the white paper, and the self-assessment tools. EC-Council stewards ADG through its AI Advisory Board rather than selling it as a licensed product.