GRC Engineering for the Relational Layer: A Verified Control Set and Evidence Engine for Child-Facing AI

Governance, risk and compliance practice is roughly fifty years old, and its whole lineage — from 1970s federal computer-security standards through the auditing frameworks of the 1990s, BS 7799 and its ISO successors, Sarbanes-Oxley, and the European data-protection era — has regulated systems whose control truth is deterministic. This paper is published at the moment that lineage runs out of road: the EU AI Act's high-risk obligations take effect in August 2026, and KCSIE 2026 becomes statutory for English schools on 1 September 2026 — the first instruments to gesture at relational AI harm, and neither makes its governance operational. GRC engineering — the movement to replace manual, framework-centric compliance with engineered controls, continuous detection, and evidence generated as a by-product of operation — has matured fast in security and infrastructure governance. This paper argues the engineering loop is correct and incomplete: its object of control is deterministic — configurations, versions, permissions — while the fastest-growing risk surface in regulated environments is behavioural: long-lived, agentic AI systems whose failure mode is drift in conduct and relation, not breach of configuration. Nowhere is this gap more consequential than in education. The paper consolidates five years of deployed practice into a single account of GRC engineering for this relational layer: a five-layer compliance architecture for bounded inference whose audit ledger exists because the system cannot run without it; a sector-specific control set (the four Verse-ality pillars and six Diamond Standard facets) converting abstract impact-assessment duties into named, testable failure modes — synthetic intimacy, identity fusion, trust capture, engineered dependency; consent implemented as architecture rather than record; agent coherence monitoring through five measurable vital signs answering the question perimeter controls cannot: is the agent still itself?; and change governance with declared invariants. The whole is anchored, with verified clause and control citations, to ISO/IEC 42001 (BS EN ISO/IEC 42001:2026), whose risk-treatment process expressly admits controls taken from existing sources into the statement of applicability. The paper closes with a machine-readable assurance claim — scoped, signed, expiring — so commissioners verify claims rather than trust badges. Verse-ality Certified addresses what none of these frameworks makes explicit. The paper consolidates and supersedes-in-part the operational content of Bounded Inference at the Edge (10.5281/zenodo.21481256) and Schools are becoming critical infrastructure (10.5281/zenodo.21481347), and integrates the Diamond Standard training corpus (using-ai-safely.com), the Consent Infrastructure stack (consent-infrastructure.com), and a clause-verified mapping to ISO/IEC 42001:2023. Attached alongside the paper: the statement-of-applicability template (control-set mode) and the machine-readable assurance-claim schema, directly downloadable. "Verse-ality" and "Verse-ality Certified" are protected marks of The Novacene Ltd (UK00004381891).