This report should be considered as a preliminary review of the potential safety, security, privacy, and ethics risk and challenges that higher education will have to consider over the next few years as XR becomes increasingly adopted for instructional purposes. We hope that others will join our effort. In particular, organizations such as EDUCAUSE should consider working with other groups such as XRSI to explore further the challenges we have outlined and ensure that vendors and developers work collaboratively with the higher education community to address the risk.

Future work should include a survey of efforts institutions have already started to address the risks described in this document and provide feedback based on lessons learned from preliminary efforts to adopt XR for instruction and learning.

After many internal discussions, we decided to organize these initial sets of recommendations based on where an institution may stand in its journey to incorporate XR for teaching and learning. Future work will incorporate surveys to understand better where institutions stand in that journey. We believe that most institutions are either:

• considering how to implement an initial campus-level XR program that will allow it to track and bring together early individual adopters who have started to experiment with the technology; or
• using an initial campus-level XR program with one or more people dedicated to operating the program and partnering with faculty on a small number of pilot projects.

A few institutions may be further along and have a larger and more mature XR program. We hope to engage with these institutions to help develop and refine the guidelines outlined in this report.

Considering the distributed and entrepreneurial nature of higher education, many colleges and universities already have a nascent ecosystem of early adopters looking at XR technologies for teaching and learning. Therefore, any institution that wants to develop or formalize an XR educational program should start by focusing on (1) connecting and engaging early adopters, power users, and potential community leaders, and (2) exploring ways to coordinate initial XR activities.

This phase should not be perceived by early adopters as another "innovation stifling, bureaucratic, top-down approach." We suggest that any communication should center around three core messages:

1. Recognizing and appreciating the work done by early adopters
2. Highlighting the institution's intent to invest in the XR ecosystem to accelerate the adoption of XR technologies in support of teaching and learning
3. Communicating the need for and importance of safe and responsible innovation that respects the privacy of students

A first move toward developing and promoting an XR program is to engage a small group of people who will lead an initial XR task force. The composition of this group should be diverse and inclusive, involving early adopters from different disciplines. This group should be empowered to engage various cross-functional stakeholders: not only faculty, academic departments, and the IT organization but also other parts of the institution as needed. The early XR adopter community should not perceive this group as a governing committee. Instead, the task force should clearly state an objective of partnering with early adopters to leverage their experience while paving a path for the larger adoption and democratization of XR technology in a safe, responsible, and ethical way.

The task force should consider how best to facilitate engagement with faculty and departments; additional funding may help in this effort. The dialogue initiated by the task force also presents an opportunity for institution-wide discussions on how XR technologies will support or accelerate current or future strategic plans.

The following are possible deliverables for this initial XR task force:

• Establish a leader or a smaller XR team that will serve as the point of contact to address existing and upcoming questions around XR, grow the XR Team, develop the first XR lab (if one does not already exist), train staff and faculty, and increase the institutional capacity in terms of positioning XR within the curricular and extracurricular activities.
• Host XR community "mixer" activities that bring XR early adopters together to share expertise and experience.
• Organize XR promotional events designed to allow early adopters to showcase their work and engage faculty/instructors who are interested in experimenting with XR in their courses.
• Create an inventory of existing institutional XR hardware and management practices. Does a department (including the library) or faculty own XR headsets that can be loaned to students? While early XR pilots were focused on the creation of instructional labs with dedicated equipment (e.g., VR headsets tethered to workstations), new standalone headsets may be harder to inventory.
• Create an inventory of courses that have adapted or experimented with XR technologies. This includes the use of VR headsets and applications, mobile AR applications, and XR-based collaboration platforms. Ideally, this inventory would be updated at the beginning of each semester. The following questions should be asked:
  • What existing XR content (e.g., applications or platforms) is being used?
  • What consent forms or guidelines do faculty provide to students as part of the course?
  • Is the course using paid XR applications/platforms or free tiers?
  • Does the course use custom content or applications, whether developed in-house or through a third party? Do other institutions share the content or applications?
  • Are XR devices used exclusively in the classroom? Are students allowed to borrow the XR headsets to take to their home or dorm room? Can students bring and use their own headsets?
  • Is there potential in the course to use an avatar or digital twin?
  • What information is there about the course format and student demographics, including whether the course is hybrid? And if applicable, are remote students located only in the United States or in other countries as well?

• Explore XR risk assessment and accessibility tools to incorporate into procurement processes and guidance.

The next phase in the journey to a meta-university or XR-empowered institution is (1) creating an XR management team and faculty development programs, (2) identifying relevant XR content, and (3) adopting XR content within the curriculum. All of this work will involve developing services to support faculty and students in XR courses, research, and labs.

Based on the participating faculty and programs, the specific content of immersive experiences and productivity applications should be identified. Workshops and seminars should be offered for faculty and students to become familiar with immersive applications. Students are key drivers in the adoption of XR. Providing curricular and extracurricular opportunities for students is an important way to generate interest in XR on campus.

Content is also one of the key drivers of XR adoption. In many cases, a small group of faculty, students, and staff can leverage existing or create custom content to prove that these technologies are having a positive impact on teaching and learning.  Students can be empowered to create research projects for custom content, and faculty can employ a full-time team of developers and 3D artists. Any content-creation efforts should follow professional software-development processes. This would include using commercially available tools for project management, source control, and development environments as well as documenting processes and all code.

The institutional XR team should evaluate which XR services should be licensed to support the first courses. These services might involve XR meeting or collaborative platforms and also management-oriented services (e.g., XR MDM solutions, XR SSO integration). Any licensing of software and solutions should follow a rigorous procurement process to ensure that data privacy and security are addressed at the institutional level.

While creating custom content can be a powerful way to rapidly prototype ideas and solutions, this method can be difficult to staff and maintain over the long term. Any custom development strategies should be combined with an evaluation of commercial platforms and solutions that allow more rapid content creation. We recommend evaluating solutions that allow students, faculty, and staff to create content on a distribution platform that prepares the institution for scaling up these efforts (see Phase 3). For an XR program to be successful, creating XR content is the single most important challenge to solve.

Another important consideration is how to supply XR devices to faculty/instructors who want to develop XR content and also to students. A loaner or grant program can facilitate access to XR devices that implement the necessary safeguards for data protection.

As work progresses, the dedicated XR team should consider drafting preliminary guidelines for the use of XR technology and services for instructional purposes. These guidelines should contain the following, at a minimum:

• A description of how student activity records that are potentially subject to FERPA and other privacy laws can be created in online environments
• Disclosure of best practices, including notifying students, via the course description or syllabus, about how personally identifiable information, such as biometric data (e.g., inputs used for facial recognition) and location data, will be collected and shared
• Directions for the use of FERPA and XR-oriented consent forms (drafted in partnership with the registrar's office and legal counsel) in instances where a faculty member wants to use XR services that have not been reviewed and vetted by the institution
• An overview of institutional and faculty obligations to provide accommodations for students who cannot use, or do not want to use, XR technology
• Recommendations regarding the use of XR devices or services as part of any class assessment activities
• Best practices for the acquisition and management of institutionally owned XR devices
• Best practices for letting students use their own personal devices to access class XR resources

The final phase is to scale up the campus XR program. Scaling up XR programs will require integrating curricula across multiple programs and schools, developing more content, and engaging with internal and external partners. To create the biggest impact, an institution should combine centralized support and departmental innovators. Having a dedicated team that can act as the hub to connect all XR labs and all faculty, students, and staff using and interested in XR will lead to successful widespread adoption.

As XR initiatives mature and grow in enrollment on campus, existing institutional policies should be updated. The following policies, if they exist, should be considered for updating: privacy policy; any policy that pertains to filming and photography; faculty handbook; student code of conduct; accessibility; technology acceptable use and cybersecurity; intellectual property; NIL rights; and out-of-state and international education and authorization. In addition, new policies should be created, as needed, to help guide and support the safe, responsible, and ethical adoption of XR. These should include policies to address the creation and use of institutional digital twins and the use of digital avatars.

Along with developing new policies, institutions should take an enterprise risk management approach in order to proactively reduce frictions and concerns susceptible to slowing down these scaling-up efforts. Therefore, the enterprise XR team, in partnership with the institutional enterprise risk management function, should initiate the following activities:

• Update technology acquisition processes to facilitate the review and procurement of XR technologies and services. The XR team should work in partnership with institutional legal counsel and cybersecurity staff to develop supplemental guidelines as needed. In particular, a data protection agreement may need to be updated to address data domains such as biometric and BID, avatars, and digital twins.
• Engage data governance staff to determine if new data domains and data stewards should be identified (e.g., who will be the data steward for the digital twin models of institutional spaces?). Data retention for XR data should be discussed.
• In conjunction with the legal counsel, address specific aspects around intellectual property, including copyrights and rights such as NIL.
• Determine the role IT governance should play as part of the adoption of XR across the institution.
• Evaluate students' use of personal XR devices. Existing student computer/technology ownership policies should be updated to provide guidance on which XR headsets are supported.
• Develop an XR risk register. This risk register should be aligned with the institutional cybersecurity risk register and should be integrated within the overall enterprise risk management program (if such a program exists).
• Provide guidelines regarding minimum requirements and recommended XR devices for institutional acquisition. These guidelines should cover multiple usage scenarios, such as using third-party platforms and services and internally developing content or applications.
• In partnership with the central IT organization and existing academic technology groups, develop processes and best practices to manage and secure institutional XR equipment. Evaluate the acquisition of XR device management software or platforms.

Institutions of higher education vary considerably in terms of size, resources, and the degree to which administrative units and processes are centralized. There is, therefore, no one-size-fits-all approach to XR compliance and risk mitigation that we can offer. We have seen successful institutions take a multi-tiered strategic approach to developing a plan that meets the goals of the institution while building on the strengths of what they have to offer. This three-step approach provides a framework for institutions to assess their progress and maximize stakeholder buy-in, create impact, and continue to grow:

• Connect & Explore
• Create & Adopt
• Scale Up

This space will continue to grow and evolve rapidly over the next two to five years, and institutions should plan to devote time and resources to continuously review and update their strategy. New devices, the evolution of XR, and its convergence with AI will continue to present opportunities for higher education to offer new solutions for learning and at the same time raise new questions. These are exciting times that require nimble but decisive teams that will push boundaries and balance privacy and security to advance the future of teaching and learning.