Security controls exist in production, but nothing is written down, so the team cannot show a supervisory authority what technical and organisational measures apply. Which accountability gap is this?

Security controls that exist in production but are undocumented create an accountability gap: inability to demonstrate appropriate technical and organisational measures as required by accountability. For citizen-facing systems, inspectors and leadership need evidence of encryption, access control, and organisational safeguards—not folklore that ‘we have locks somewhere.’ Treating undocumented controls as automatic EU AI Act certification fails by mixing regimes and inventing a free pass from missing security documentation. Claiming supervisory authorities may never request security documentation fails on enforcement reality—investigative powers routinely reach TOMs. Confirming that verbal assurances alone permanently satisfy Article 32 fails: accountability expects demonstrable measures, not oral promises. Exam caveat: the GDPR demands appropriate TOMs and the ability to demonstrate them; perfect paperwork without real controls also fails, but this scenario’s specific gap is demonstrability. Operational check: document the TOM baseline (access, encryption, logging, backups, vendors), map controls to systems processing personal data, retain evidence for audits, and rehearse producing the pack for an SA information request within a fixed SLA.