Plenty of people have an opinion on an enterprise purchase of a large language model (LLM). Far fewer have the authority to say no. In G2’s AI Custom Research interviews with 102 US enterprise leaders, 77 named someone with veto power over an LLM decision. Of those, 87% pointed to a risk or governance team and only 13% named finance, procurement, the board, or executive budget authority.
That split shapes how an LLM deal gets won. For 45% of leaders, decision rights are shared, so a model has to win over the people who ran the test and the finance or security owners who didn’t.
If you’re trying to get an LLM approved, this article shows who decides, what most often puts a deal at risk, which controls leaders expect before a model goes live, and what slows adoption inside a company.
The person who owns the budget for an enterprise LLM rarely has the final say. Of the 77 leaders who named someone with veto power, 87% pointed to a risk or governance team: security, privacy, legal, compliance, or a cross-functional governance group. Only 13% named finance, procurement, the board, or executive budget authority.
Most of the leaders G2 interviewed are hands-on in choosing models: of the 100 who described their role, 61% are, and the rest hold a governance or recommendation role or own the budget.
For a model going into a customer-facing product, about two-thirds of the leaders who described the process said sign-off runs through IT, security, legal, and governance. These teams want proof of safety, accuracy, and data protection.
"We need to have quite a solid QA team and a security team who will validate the safety of this model to go to the customers."
Director of engineering and quality assurance
Telecommunications company
of leaders who named a veto holder pointed to a risk or governance team.
Source: G2 Data
Enterprise LLM deals most often come close to failing over security, privacy, or data-exposure risk. When leaders described the most recent time their organization chose a model, 75 named a dealbreaker or near-dealbreaker, and 59% of them pointed to security, privacy, or data exposure. Failure in real-world task quality came next at 28%, followed by pricing or token economics at 13%.
G2’s interviews don’t follow deals through formal security reviews, so they can’t show how those reviews play out. They show what nearly stopped a purchase.
Before deploying an LLM, enterprises look first for access controls, permissions, and sensitive-data governance, then for privacy, security, and retention controls built into the product. Asked what it takes to run a model day to day, setting quality and cost aside, 43% of 98 leaders put access, permissions, and sensitive-data governance at the top. A third named integration with enterprise systems and workflows, and the rest monitoring, adoption, and support.
After those come custom review and workflow guardrails, then spend limits and human oversight. Of the 81 leaders asked how they handle controls around an LLM, 42% rely on the built-in access, privacy, and retention controls their vendor ships, a third have built custom monitoring, review, and workflow guardrails on top, and a quarter have added spend limits and human oversight.
The stakes change the standard. Of 58 leaders, 45% said customer-facing and sensitive workflows face a higher accuracy and safety standard, while routine internal work prioritize efficiency and lower cost. For the highest-stakes uses, leaders want two things in roughly equal measure: human oversight with validation on real workloads and proof of accuracy, reliability, and low hallucination rates.
LLM adoption within a company slows due to security, retention, audit, and compliance requirements, with legacy-system integration and single sign-on (SSO) friction close behind. Of the 55 leaders who described a specific requirement that slowed or blocked adoption, 38% named security and compliance requirements. The other 62% split evenly between connecting the model to legacy systems and getting SSO, permissions, and provisioning to work.
SSO friction shows how a small setup issue can slow adoption. At one education organization, the lag in adding users to SSO produced a steady stream of complaints and a manual workaround run by the person who chose the model. “The SSO has been a huge problem for us,” a leader there said.
It leaves buyers with one job to do before any other: winning over the security, legal, and governance teams that can say no. The findings point to three moves:
Vendors that publish their controls as a checklist that maps to a buyer’s review make that last step easier.
Security, legal, and governance teams hold the final no for most of the leaders who named a veto holder. Of the 77 who did, 44% pointed to security, privacy, legal, or compliance teams, and 43% to a cross-functional governance group. Only 13% named finance, procurement, the board, or executive budget authority.
In G2’s interviews, security is the most common near-dealbreaker. Of 75 leaders who named one, 59% cited security, privacy, or data exposure, ahead of task quality (28%) and pricing (13%).
Access, permissions, and sensitive-data governance come first, followed by privacy, security, and retention controls built into the product. Of 81 leaders, 42% rely on the controls their vendor ships.
Of 55 leaders who described a requirement that slowed or blocked adoption, 38% named security, retention, audit, and compliance requirements, and the rest split evenly between legacy-system integration and SSO and provisioning friction.
We ran 102 AI-led, open-ended interviews with US enterprise leaders in August and September 2026. Participants included CIOs, CTOs, CFOs, and heads of AI who evaluate, select, or fund LLMs. Of the 100 who described their role, 61% are hands-on in choosing models, 21% hold governance or recommendation roles, and 18% own the budget.
Of the 93 who named an industry, 49% work in healthcare, education, the public sector, or industrial companies. Another 33% work in technology, software, and professional services, and 17% in financial services, insurance, and banking.
Not every leader answered every question, so each figure shows how many people it’s based on. With 102 interviews, percentages show direction more than precision, and results from groups smaller than 30 are directional. All respondents are in the United States, so the findings describe these buyers and not the whole market.