how much of ai compliance and eu ai act readiness is documentation vs real technical controls

we're eu-facing enough that this isn't optional. And every consultant conversation so far has been heavy on documentation and risk classification paperwork...like light on what technical controls need to exist underneath it. now what i can't get a straight answer on is whether ai compliance and eu ai act readiness can be documentation alone or whether an assessor is going to want to see the technical control running, not just described. and specifically around the testing and monitoring obligations for high-risk systems, is a written risk assessment enough or do they expect live evidence of te