Who Has the Power to Veto an Enterprise LLM? For 87% of Leaders, It’s Not the Budget Holder

Many individuals hold opinions about enterprise purchases of large language models (LLMs), but far fewer have the authority to veto such decisions. According to G2’s AI Custom Research interviews with 102 US enterprise leaders, 77 identified someone with veto power over LLM acquisitions. Among them, 87% indicated that risk or governance teams hold this authority, while only 13% pointed to finance, procurement, the board, or executive budget authorities.

This distribution influences how LLM deals are approved. For 45% of leaders, decision-making is shared, requiring approval both from those conducting tests and from finance or security personnel who may have reservations.

If you aim to secure approval for an LLM purchase, this article outlines who holds decision-making power, common risks that jeopardize deals, security controls expected before deployment, and factors that hinder adoption within organizations.

Summary: Who Can Veto Enterprise LLM Purchases

Approval Authorities: Risk and governance teams predominantly determine whether LLM purchases proceed—87% of 77 leaders with veto insight referenced these teams, 44% mentioned security, privacy, legal, or compliance groups, and 43% cited cross-functional governance. Only 13% referred to finance, procurement, executive budget, or board members.
Deal Failures in Security Reviews: Security concerns are the primary reason LLM deals nearly fall through. Among 75 leaders reporting dealbreakers or near-dealbreakers, 59% identified security, privacy, or data exposure issues, surpassing task quality (28%) and pricing (13%).
Essential Security Controls: Beyond quality and cost, daily model operation centers on managing user access and sensitive data governance. Of 98 leaders, 43% prioritize access permissions and data governance as critical controls before deployment.
Control Stringency for High-Stakes Use Cases: For customer-facing or sensitive workflows, 45% of 58 leaders demand stricter accuracy and safety standards compared to routine internal tasks.
Adoption Barriers: Security and configuration requirements slow LLM adoption. Of 55 leaders reporting obstacles, 38% highlighted security, retention, audit, and compliance demands; the remainder cited legacy system integration and challenges with
Plenty of people have an opinion on an enterprise purchase of a large language model (LLM). Far fewer have the authority to say no. In G2’s AI Custom Research interviews with 102 US enterprise leaders, 77 named someone with veto power over an LLM decision. Of those, 87% pointed to a risk or governance team and only 13% named finance, procurement, the board, or executive budget authority.
That split shapes how an LLM deal gets won. For 45% of leaders, decision rights are shared, so a model has to win over the people who ran the test and the finance or security owners who didn’t.
If you’re trying to get an LLM approved, this article shows who decides, what most often puts a deal at risk, which controls leaders expect before a model goes live, and what slows adoption inside a company.
TL;DR: Who can veto an enterprise LLM purchase
- Who approves LLM purchases in large companies? Risk and governance teams usually decide whether a purchase stops: 87% of the 77 leaders who named a veto holder pointed to them, 44% to security, privacy, legal, or compliance teams and 43% to a cross-functional governance group. Only 13% named finance, procurement, the board, or executive budget authority.
- Why do enterprise LLM deals fail security review? Security is what most often nearly ends an LLM choice: 59% of the 75 leaders who named a dealbreaker or near-dealbreaker in their most recent model choice pointed to security, privacy, or data exposure, ahead of task quality (28%) and pricing (13%).
- What security controls do enterprises need before deploying an LLM? Setting quality and cost aside, the daily work of running a model is deciding who can use it and what sensitive data it can reach: 43% of 98 leaders put access, permissions, and sensitive-data governance at the top of what it takes to run a model.
- Do higher-stakes LLM use cases need stricter controls? Higher stakes raise the standard: 45% of 58 leaders said customer-facing and sensitive workflows need a higher accuracy and safety bar than routine internal work.
- What slows LLM adoption inside a company? Security and setup requirements slow adoption: of the 55 leaders who described what slowed or blocked it, 38% named security, retention, audit, and compliance requirements, and the rest split evenly between legacy-system integration and friction with single sign-on, permissions, and provisioning.
Who approves LLM purchases in large companies?
The person who owns the budget for an enterprise LLM rarely has the final say. Of the 77 leaders who named someone with veto power, 87% pointed to a risk or governance team: security, privacy, legal, compliance, or a cross-functional governance group. Only 13% named finance, procurement, the board, or executive budget authority.
Most of the leaders G2 interviewed are hands-on in choosing models: of the 100 who described their role, 61% are, and the rest hold a governance or recommendation role or own the budget.
For a model going into a customer-facing product, about two-thirds of the leaders who described the process said sign-off runs through IT, security, legal, and governance. These teams want proof of safety, accuracy, and data protection.
“We need to have quite a solid QA team and a security team who will validate the safety of this model to go to the customers.”
Director of engineering and quality assurance
Telecommunications company
87%
of leaders who named a veto holder pointed to a risk or governance team.
Source: G2 Data
Why do enterprise LLM deals fail security review?
Enterprise LLM deals most often come close to failing over security, privacy, or data-exposure risk. When leaders described the most recent time their organization chose a model, 75 named a dealbreaker or near-dealbreaker, and 59% of them pointed to security, privacy, or data exposure. Failure in real-world task quality came next at 28%, followed by pricing or token economics at 13%.
G2’s interviews don’t follow deals through formal security reviews, so they can’t show how those reviews play out. They show what nearly stopped a purchase.
What security controls do enterprises need before deploying an LLM?
Before deploying an LLM, enterprises look first for access controls, permissions, and sensitive-data governance, then for privacy, security, and retention controls built into the product. Asked what it takes to run a model day to day, setting quality and cost aside, 43% of 98 leaders put access, permissions, and sensitive-data governance at the top. A third named integration with enterprise systems and workflows, and the rest monitoring, adoption, and support.
After those come custom review and workflow guardrails, then spend limits and human oversight. Of the 81 leaders asked how they handle controls around an LLM, 42% rely on the built-in access, privacy, and retention controls their vendor ships, a third have built custom monitoring, review, and workflow guardrails on top, and a quarter have added spend limits and human oversight.
The stakes change the standard. Of 58 leaders, 45% said customer-facing and sensitive workflows face a higher accuracy and safety standard, while routine internal work prioritize efficiency and lower cost. For the highest-stakes uses, leaders want two things in roughly equal measure: human oversight with validation on real workloads and proof of accuracy, reliability, and low hallucination rates.
What slows LLM adoption inside a company?
LLM adoption within a company slows due to security, retention, audit, and compliance requirements, with legacy-system integration and single sign-on (SSO) friction close behind. Of the 55 leaders who described a specific requirement that slowed or blocked adoption, 38% named security and compliance requirements. The other 62% split evenly between connecting the model to legacy systems and getting SSO, permissions, and provisioning to work.
SSO friction shows how a small setup issue can slow adoption. At one education organization, the lag in adding users to SSO produced a steady stream of complaints and a manual workaround run by the person who chose the model. “The SSO has been a huge problem for us,” a leader there said.
Where does that leave enterprise LLM buyers?
It leaves buyers with one job to do before any other: winning over the security, legal, and governance teams that can say no. The findings point to three moves:
- Bring security, legal and governance early. They are the ones who can stop a purchase.
- Arrive with proof of safety, accuracy, and data protection. That’s what sign-off teams want to see for anything customer-facing.
- Ask vendors to show their controls up front. That means access controls, retention guarantees, audit logs, and SSO that work from day one.
- Test SSO, permissions, and legacy-system connections early. Friction there slowed adoption for many of the leaders who described a requirement.
Vendors that publish their controls as a checklist that maps to a buyer’s review make that last step easier.
Frequently asked questions
Q1. Who approves LLM purchases in large companies?
Security, legal, and governance teams hold the final no for most of the leaders who named a veto holder. Of the 77 who did, 44% pointed to security, privacy, legal, or compliance teams, and 43% to a cross-functional governance group. Only 13% named finance, procurement, the board, or executive budget authority.
Q2. Why do enterprise LLM deals fail security review?
In G2’s interviews, security is the most common near-dealbreaker. Of 75 leaders who named one, 59% cited security, privacy, or data exposure, ahead of task quality (28%) and pricing (13%).
Q3. What security controls do enterprises need before deploying an LLM?
Access, permissions, and sensitive-data governance come first, followed by privacy, security, and retention controls built into the product. Of 81 leaders, 42% rely on the controls their vendor ships.
Q4. What slows LLM adoption inside a company?
Of 55 leaders who described a requirement that slowed or blocked adoption, 38% named security, retention, audit, and compliance requirements, and the rest split evenly between legacy-system integration and SSO and provisioning friction.
Research methodology
We ran 102 AI-led, open-ended interviews with US enterprise leaders in August and September 2026. Participants included CIOs, CTOs, CFOs, and heads of AI who evaluate, select, or fund LLMs. Of the 100 who described their role, 61% are hands-on in choosing models, 21% hold governance or recommendation roles, and 18% own the budget.
Of the 93 who named an industry, 49% work in healthcare, education, the public sector, or industrial companies. Another 33% work in technology, software, and professional services, and 17% in financial services, insurance, and banking.
Not every leader answered every question, so each figure shows how many people it’s based on. With 102 interviews, percentages show direction more than precision, and results from groups smaller than 30 are directional. All respondents are in the United States, so the findings describe these buyers and not the whole market.