EC-Council Launches ADG Framework for Enterprise AI Governance and Security

EC-Council has launched the Adopt. Defend. Govern. AI Framework, a new enterprise framework intended to help organizations manage AI adoption, security, and governance.

A framework for AI adoption, defense, and governance

According to EC-Council’s announcement, the ADG AI Framework is designed as an operating model for organizations deploying AI systems at scale. The organization says the framework is structured around three pillars: Adopt, Defend, and Govern.

EC-Council describes the release as paired with a free AI Readiness Self-Assessment Tool, which is intended to help organizations evaluate their current maturity and identify gaps before expanding AI use across business functions.

CXOtoday, which covered the launch, reported that the framework includes 12 minimum controls and is mapped to major AI governance, security, and risk references, including the EU AI Act, ISO/IEC 42001, the NIST AI Risk Management Framework, OWASP guidance, and MITRE ATLAS.

Twelve controls and nine governance surfaces

EC-Council’s launch materials say ADG includes 12 minimum controls and nine governance surfaces. The organization frames these as practical structures for responsible AI governance rather than a replacement for existing regulatory or standards programs.

The official ADG framework page from EC-Council Global Services describes ADG V1.0 as practitioner-led and vendor-neutral. It also states that the framework is mapped to NIST AI RMF, ISO/IEC 42001, and the EU AI Act, aligning the framework with widely referenced approaches to AI risk management and governance.

EC-Council’s announcement further says the framework is intended to address challenges that arise as enterprises move from experimentation to broader AI deployment. Those challenges include oversight, security controls, policy alignment, and operational readiness.

Positioning against emerging AI regulation

The timing of the ADG launch reflects a broader market shift toward formal AI governance programs. The EU AI Act is already shaping compliance planning for organizations that build or deploy AI systems in Europe, while ISO/IEC 42001 provides a management-system standard for AI governance. NIST’s AI Risk Management Framework is also widely used as voluntary guidance for identifying and managing AI-related risks.

By mapping ADG to these reference points, EC-Council is positioning the framework as a bridge between internal AI operations and external governance expectations. However, the available materials do not establish that using ADG alone would satisfy any specific legal obligation or certification requirement. Organizations would still need to assess their own regulatory exposure, technical systems, and jurisdiction-specific duties.

A security-focused entry in AI governance

EC-Council is best known for cybersecurity training and certification programs, and the ADG materials emphasize security and defensive controls alongside governance. The inclusion of OWASP and MITRE ATLAS mappings reflects that focus: OWASP publishes security guidance used by software and application security teams, while MITRE ATLAS documents adversarial tactics and techniques involving AI systems.

For enterprises, the practical value of ADG will depend on how clearly the framework’s controls can be implemented, measured, and integrated with existing risk, compliance, and security programs. EC-Council’s self-assessment tool may help teams begin that process, but the sources reviewed describe it at a high level rather than providing independent evidence of adoption or effectiveness.

What to watch

The framework’s next test will be whether organizations use it beyond initial readiness assessments. Areas to watch include whether EC-Council publishes detailed implementation guidance, whether independent practitioners validate the 12 controls in operational environments, and how the framework evolves as AI regulation and standards continue to mature.

For now, the launch adds another structured option for companies trying to turn AI governance from policy language into operating practice, with EC-Council emphasizing security, responsible use, and alignment with established AI risk frameworks.