From what I've been told elsewhere, for tournaments they mainly check to see if items/Pokemon have just appeared out of nowhere, and can also check the PIDs of Pokemon to see if they've been messed with. I think they only do the check for the Pokemon in your party, but I'm not really sure.
A good general guideline to keep in mind is that if you're altering/obtaining a Pokemon in some way that wouldn't be possible without using the AR, it will most likely be considered hacked.
As far as items go, the only time you'd run into any problems using those would be if you hacked for an unreleased event item (like the Azure Flute) caught a wild Pokemon in a Cherish Ball, or a Safari Ball (outside the Safari Zone) etc. TMs and things like that would be perfectly fine to use and wouldn't affect the legitimacy of your Pokemon.