Most communications teams are now using AI tools faster than their governance can keep up. Until that gap is closed, the cost of any AI incident is paid in public trust, not in budget. Trustees, donors, and regulators are already asking. The press will follow. The fix is not to lock AI down. The audit starts from what your team already does well with it, names the risks honestly, and builds governance around that capability rather than over it.