Security controls exist in production, but nothing is written down, so the team cannot show a supervisory authority what technical and organisational measures apply. Which accountability gap is this?

Accountability requires controllers (and processors as applicable) to implement appropriate technical and organisational measures and to be able to demonstrate compliance. Undocumented production controls hinder that demonstration to a supervisory authority. Verbal assurances and unrelated AI Act certification do not close the gap.