From Principles to Practice: A Risk–Control–Governance Framework for Ethical Metaverse Ecosystems in the Age of Generative AI

Abstract

Metaverse ethics is well described but rarely put into practice. Recent reviews list ethical themes, controls and governance initiatives side by side. They seldom show which risk is covered by which control or rule. They also predate the EU regulatory changes of 2025–2026 and the fast spread of generative AI (GenAI) in immersive worlds. This paper proposes a Risk–Control–Governance (RCG) framework. It extends the macro–meso–micro logic of earlier reviews with a control layer, a governance layer and a GenAI amplification layer. We synthesise four recent reviews and verified regulatory sources. We map eleven risk domains to technical and organisational controls. We then score each domain against seven governance instruments: the GDPR, the Digital Services Act, the EU AI Act (as amended in July 2026), the EU Web 4.0 strategy, World Economic Forum work, IEEE XR ethics guidance and platform self-regulation. Binding law gives direct, enforceable coverage in eight of the eleven domains. Inclusion and accessibility, economic fairness and environmental sustainability rely on soft law alone. Soft-law instruments touch many topics but set few concrete duties. Even strong coverage has gaps: inferred biometric data, phased AI Act duties and a 16-month interim gap for high-risk AI. A sensitivity check shows that the main findings are stable. However, four domains depend on a single binding instrument. We also offer a worked example, a stakeholder roadmap and three testable propositions.