The regulation and commentary just say that notice to business customers can be given orally or in writing (with the slight variations for businesses with revenue of $1 million or less. Now, for a list of documentation needed, I would expect to see that in writing simply for the practical reason that the bank wants to be on record as to what it requested and to have something to check against as materials are received. The bank should document all communication for legal reasons in the event problems and disagreements arise further down the road. An undocumented file is dangerous.
Ongoing updates are not required to be in writing, but again, communication with the customer needs to be documented to protect the bank and for practical reasons some of that will be in writing, perhaps verifying a verbal conversation.