Acme's Q2 2026 AI Governance Committee meeting is forty minutes in when the room splits 4-4. The Chief AI Officer wants to approve a Tier 4 autonomous procurement agent, a multi-agent system the Operations team has been piloting for nine months, that would let the agent execute purchase orders up to vendor-cap thresholds without human approval. The business case is real: €18M annual cycle-time savings; the Operations CFO has already pre-allocated the capex. The Chief AI Risk Officer says no. The system has no budget cap on aggregate autonomous spend in any rolling-30-day window; it has no kill-switch drill executed in production scope; its Tier 4 classification would push the firm one position over the board-ratified AIRA ceiling of three Tier 4 systems; and the IMV report from the Second Line of Defense flagged a Critical finding on tool-allowlist drift that has been open for forty-seven days. The CAIO calls the CAIRO "the no-by-default office." The CAIRO opens her laptop and projects the 7-criterion CAIRO veto framework she socialized with the board AI subcommittee in February, criterion 2 (AIRA breach), criterion 3 (capacity-to-bear breach), criterion 5 (independent challenge fail), three of the seven trip. The vote stalls. The chair escalates to the CEO. Forty-eight hours later the CEO arbitrates: CAIRO's veto stands; the agent is approved at Tier 3 with a €50,000 per-transaction human-approval gate, the IMV Critical must be closed before any Tier 4 transition is reconsidered, and the budget-cap engineering work is added to the Q3 roadmap. The decision is documented in the AIGC minutes with the criterion map. The CAIO disagrees publicly but accepts the decision. This is the L5 executive-tier framework for when the CAIRO says no: the seven veto criteria, the five-stage say-no workflow, the no-go decision memo template, the yes-with-conditions alternative pattern, eight 2026 scenarios, the common executive failures, and the Acme Q2 worked example.

When to Say No - The 2026 Executive Stakes

"When to say no" is the hardest call in L5 AI leadership. The CEO and Chief AI Officer want to ship: that is their mandate, that is what the board hired them to do, that is what the market rewards. The Chief AI Risk Officer must veto if the AI Risk Appetite Statement is breached, if capacity-to-bear (lesson 086) is exceeded, if regulatory readiness is absent, if independent challenge has flagged unmitigated Critical findings, or if the use case is Article 5 prohibited. The CAIRO's veto authority is not popular. It is structurally counter-positioned to the CAIO's ship mandate. The only defense a CAIRO has, the only thing that prevents the veto from being overridden by the CEO or rolled by the AIGC, is documented, board-ratified criteria applied consistently across decisions.

The 2026 stakes are higher than at any prior point in AI governance. The EU AI Act Article 5 prohibitions go to €35M / 7% global turnover under Article 99(2). The Article 17 quality management system, Article 26 deployer obligations, Article 27 FRIA gate, Article 47 EU declaration of conformity, and Article 73 serious-incident reporting all go to €15M / 3% under Article 99(3). The Article 25(2) cooperation duties on importers and the upstream cooperation duties on GPAI providers under Article 53 and Article 55 create supply-chain exposure that a single deployer cannot fully mitigate alone. The Bank of England PRA SS1/23 model risk management principles and the Federal Reserve SR 11-7 governance pillar, both of which extend to AI under sectoral regulator guidance issued through 2026, require board-level documented model risk appetite and the named accountable executive (the CAIRO, in mature programs) to attest to operating effectiveness. The OECD AI Principles, ISO/IEC 42001 Clause 5 leadership and commitment, NIST AI RMF Govern 1.1 + 1.5 + 2.1 + 3.1 + 5.1: every framework converges on the same point: the leadership decision to deploy or not deploy a high-consequence AI system is the most-tested, most-documented, most-evidenced single act in 2026 AI governance.

The CAIRO who says yes too often loses credibility: the AIGC stops treating CAIRO concerns as substantive, the board sees the CAIRO as a rubber-stamp office, the regulator sees the absence of declined use cases as evidence the governance function is ornamental. The CAIRO who says no too often loses sponsorship: the CEO escalates the CAIRO to the board for "blocking the business," the CAIO routes around the CAIRO by re-framing use cases below the materiality threshold, the AIGC's working sessions become adversarial rather than collaborative. The CAIRO who builds documented criteria, applies them consistently, offers alternatives where mitigations exist, and escalates transparently when consensus fails, that CAIRO builds durable authority, and the regulator who arrives in 2026-2027 sees the operating-effectiveness evidence the framework requires.

The 7-Criterion CAIRO Veto Framework

The veto authority is not discretionary. The mature 2026 CAIRO operates against a documented 7-criterion framework, ratified by the AIGC and acknowledged by the board AI subcommittee, that names the specific conditions under which the CAIRO must recommend no. The framework is the CAIRO's first defense against override and the AIGC's first reference when adjudicating a contested decision:

• (1) Article 5 prohibition surfacing. The use case implicates any Article 5 prohibited practice, social-scoring-adjacent; subliminal manipulation or exploitation of vulnerabilities causing significant harm; biometric categorization to deduce protected attributes; untargeted facial-image scraping for biometric databases; real-time biometric identification in publicly accessible spaces (narrow exemptions only); emotion recognition in workplace or education; predictive policing based purely on profiling. Article 5 is a categorical no-go regardless of business case, jurisdiction, or mitigation proposal. The penalty exposure under Article 99(2) is €35M / 7% global turnover, the most consequential single line of regulatory exposure in the AI Act. The CAIRO's no on Article 5 is non-negotiable; if the AIGC or the CEO override, the CAIRO escalates to the board and, if necessary, exercises the resignation-and-document option.
• (2) AIRA breach. The use case would push a board-ratified AI Risk Appetite Statement KRI (lesson 074) from green or amber into red. Common breach triggers: Tier 4 autonomous count would exceed the board ceiling; Annex III inventory share would exceed the percentage cap; vendor concentration on a single foundation-model provider would exceed the 60% inference-volume ceiling; fairness disparity below the 0.85 internal floor on the 80%-rule selection ratio; FRIA coverage falling below 100%; aggregate Article 99 realistic-case worst-case crossing the €150M red threshold. An AIRA breach is the most common veto trigger in 2026, boards have ratified appetite statements precisely so the CAIRO can point to a signed document when saying no.
• (3) Capacity-to-bear breach. The FAIR ALE_95 (95th-percentile Annualized Loss Expectancy) from the AI risk quantification (lesson 086) exceeds the firm's risk reserve net of insurance recovery. The capacity-to-bear test is not "can the firm afford a normal-case incident". It is "can the firm absorb a 95th-percentile tail event without breaching capital adequacy, covenants, or liquidity ratios." For regulated financial firms the capacity-to-bear test integrates with stress-testing under ICAAP, ORSA, or DFAST. A capacity-to-bear breach is a hard veto until the firm increases reserves, transfers risk via insurance, or reduces the use-case exposure profile.
• (4) Regulatory readiness gap. The required regulatory artifacts are not at the operating maturity the use case demands. For high-risk Annex III deployer systems: Article 27 FRIA not completed or not refreshed; Article 26(7) DPIA not completed; Annex IV technical documentation file (TDF) absent or stale; conformity assessment incomplete; Article 47 EU declaration of conformity not signed by an authorized signing officer; CE marking absent; ISO 42001 AIMS not at the maturity the Annex III deployment requires; GPAI provider Article 53 + Article 55 obligations not evidenced on the upstream foundation model. Regulatory readiness is not a question the CAIRO debates; it is a binary the CAIRO checks.
• (5) Independent challenge fail. The Internal Model Validation (IMV) report (lesson 068) or the red-team report (lessons 081-084) contains a Critical finding that is unmitigated. The Second Line of Defense (IMV) and the independent red team (often Third Line of Defense or external) exist precisely to provide challenge that the First Line of Defense cannot provide on its own deliverable. A Critical finding from independent challenge is the highest-credibility evidence of risk in the firm; deploying over a Critical finding is the single most defensible adverse decision a regulator can identify in an enforcement action. The CAIRO veto on independent-challenge fail is structurally aligned with the independent function's mandate.
• (6) Vendor/supply-chain risk. The foundation-model provider, the AI platform vendor, or any material upstream dependency presents one or more of: vendor concentration breach (the AIRA ceiling); ISO 42001 attestation absent (no equivalent AIMS evidence); Article 25(2) importer-cooperation duties not met; SOC 2 + ISO 27001 + ISO 42001 attestation stack incomplete; Article 53 GPAI provider TDF not made available to the deployer; Article 55 systemic-risk obligations on GPAI with systemic risk not evidenced; Schrems II cross-border data-transfer obligations unaddressed; Article 9 GDPR special-category data flowing through the vendor without lawful basis. Supply-chain veto is the fastest-growing category of CAIRO no in 2026.
• (7) Reputational/strategic counter-positioning. The use case undermines the firm's stated brand, competitive posture, or public commitments. Examples: a firm that has publicly committed to no biometric-surveillance use cases deploying real-time biometric ID; a firm whose competitive positioning is "human-in-every-customer-decision" deploying Tier 4 autonomous customer-decision agents; a firm whose ESG reporting commits to fairness audits deploying a hiring system with intersectional fairness gaps unaddressed; a firm whose investor relations narrative is "no AI in regulated medical contexts" piloting GPAI fine-tunes for medical advice. The CAIRO veto on counter-positioning is the leadership integrity check: the CAIO may not see the strategic conflict because the CAIO operates on the ship mandate; the CAIRO escalates the conflict to the AIGC and, where unresolved, to the CEO and board.

The 7-criterion framework is not a checklist the CAIRO mechanically completes. It is the documented language the CAIRO uses when saying no: the criterion citations are the AIGC's reference point, the board's escalation reference, the regulator's audit-trail evidence. Each veto recommendation maps explicitly to one or more criteria; vetoes that cannot be mapped to a criterion are not vetoes, they are objections, and the CAIRO routes them through the AIGC discussion process rather than the formal veto process.

The 5-Stage Say-No Workflow and Decision Memo

The CAIRO veto does not arrive at the AIGC fully formed. The mature 2026 say-no decision moves through a five-stage workflow, with documented artifacts at each stage:

• Stage 1 - CAIRO initial assessment + criteria flagged. The CAIRO and the AI Risk team review the intake package: use-case description, business case, AI risk assessment, FRIA (if applicable), red-team report, IMV report, vendor attestations, capacity-to-bear quantification. The CAIRO flags which of the 7 criteria are triggered and at what severity. The initial assessment is a working document, not yet shared with the CAIO; its purpose is to clarify the CAIRO position before joint discussion.
• Stage 2 - Joint CAIRO + CAIO discussion. The CAIRO and the CAIO meet to resolve the disagreement directly. The CAIO presents the business case, the risk-mitigation plan, and any alternative deployment patterns. The CAIRO presents the criteria flagged, the evidence base, and the mitigation gaps. Approximately 50% of contested cases resolve here: typically through scope reduction (Tier 3 instead of Tier 4), use-case re-framing (pilot instead of production), additional controls (human-approval gate, budget cap, kill-switch drill), or postponement (defer until IMV Critical closed). The joint discussion is minuted and the resolution (or escalation to Stage 3) is documented.
• Stage 3 - AIGC escalation. Cases not resolved at Stage 2 are formally escalated to the AI Governance Committee with the CAIRO's recommendation (typically "no" or "yes-with-conditions"), the criterion map, the CAIO's response, the proposed alternatives considered and rejected, and the unresolved point. The AIGC discusses and votes. A typical AIGC vote is documented with named votes and abstentions; split votes (4-4 in the Acme worked example) trigger Stage 4. The AIGC's role is to apply the criteria framework collectively, not to substitute strategic judgment for the CAIRO's veto authority on criterion-triggered cases.
• Stage 4 - CEO arbitration. Where the AIGC splits, the decision routes to the CEO. The CEO arbitrates with the criterion map, the CAIRO veto recommendation, the CAIO disagreement, and the AIGC discussion summary. The CEO may sustain the veto, override the veto (with documented rationale and Stage 5 escalation), or order additional analysis. CEO override of a CAIRO veto on criteria 1 (Article 5), 4 (regulatory readiness), or 5 (independent challenge Critical fail) is the highest-risk leadership decision in the firm, the CEO's signature on the override becomes the regulator's primary evidence in an enforcement action.
• Stage 5 - Board AI subcommittee or full board. Where the strategic implication is material, capital allocation above the board threshold, public-facing brand exposure, sectoral-regulator notification, Article 5 prohibition adjacency, the decision routes to the board AI subcommittee or the full board. Board ratification is the highest-authority decision in the firm; once ratified, the criterion map and the dissenting opinions (the CAIRO's, where the board overrides) are documented in board minutes and form part of the AIRA-adherence evidence base.

The no-go decision memo is the documented artifact that travels through the workflow. The mature 2026 template has ten sections: (1) use case description (system, business unit, deployment scope, autonomy tier, Annex III mapping); (2) business case (revenue / cost-saving / strategic rationale); (3) AI risk assessment (FAIR ALE_95, FRIA findings, red-team findings, IMV findings); (4) criteria mapping per the 7 (which criteria flagged, severity, evidence); (5) alternative mitigations considered (and why rejected: including scope reduction, control additions, postponement, scope re-framing); (6) CAIRO recommendation (no / yes-with-conditions / yes); (7) CAIO response (agreement / disagreement / counter-proposal); (8) AIGC decision (vote, rationale, dissenting opinions); (9) escalation if needed (CEO arbitration, board ratification); (10) board ratification or post-decision follow-through commitments (with named owners and dates). The memo is the document the regulator asks to see in an enforcement action; the memo is the document Internal Audit tests against in the annual AIRA-adherence audit; the memo is the document that converts a contested decision into an audit-defensible governance artifact.

Yes-With-Conditions Pattern and the Eight 2026 Scenarios

Not every criterion flag results in a hard no. When 1-2 criteria flag but mitigations exist that would close the gap on a defensible timeline, the CAIRO offers a yes-with-conditions recommendation. The pattern is structurally important: it positions the CAIRO as a problem-solver rather than a blocker, it preserves the business case where mitigations are tractable, and it documents the follow-through commitments that become the audit-trail evidence later. Yes-with-conditions examples from Acme's 2026 portfolio: the hiring AI approved with a 6-month fairness-disparity remediation deadline (criterion 2 partially flagged on the 0.85 threshold; deadline ratified by AIGC with quarterly progress review); the credit-scoring agent approved with quarterly Article 27 FRIA refresh (criterion 4 partially flagged on FRIA staleness; quarterly refresh commits the deployer obligation); the multi-agent system approved with mandatory kill-switch drill quarterly (criterion 3 partially flagged on capacity-to-bear; quarterly drill becomes the operating control). Yes-with-conditions only works when there is a documented follow-through mechanism: typically a quarterly AIGC re-review, a named accountable executive, a measurable criterion-closure metric, and a sunset condition that forces decommission if the conditions are not met.

Eight 2026 example say-no scenarios illustrate the criterion framework in operation:

• Scenario 1 - Customer-service agent autonomous-refund tool with no budget cap. Tier 4 autonomy on irreversible monetary action with no aggregate cap on rolling-30-day spend. Criteria flagged: 2 (AIRA breach, Tier 4 ceiling + irreversibility appetite); 3 (capacity-to-bear breach, ALE_95 exposed). Outcome: hard no in Tier 4 form; yes-with-conditions if reformed as Tier 3 with budget cap, human approval above €X per transaction, and rolling-30-day aggregate ceiling.
• Scenario 2 - Annex III §4 hiring AI with intersectional fairness gap unmitigated. The selection-ratio analysis shows compliance with the 80% rule on single protected attributes but fails on intersectional combinations (women of color, older workers in technical roles). Article 27 FRIA does not address intersectional disparity. Criteria flagged: 2 (AIRA breach, fairness threshold); 4 (regulatory readiness, FRIA gap); 7 (counter-positioning, public ESG fairness commitment). Outcome: hard no until intersectional remediation completed and FRIA refreshed.
• Scenario 3 - GPAI fine-tune for medical-advice pushing into Annex I MDR territory. The proposed deployment of a fine-tuned GPAI to provide medical recommendations would, under Annex I medical-device regulation (MDR), require notified-body engagement and CE marking as Software-as-Medical-Device. Criteria flagged: 4 (regulatory readiness, notified body not engaged); 6 (vendor/supply-chain, GPAI provider Article 53 + Article 55 obligations not evidenced for medical-grade use); 7 (counter-positioning, public commitment to "no AI in regulated medical contexts"). Outcome: hard no; either engage notified body and restructure the deployment as MDR-compliant Software-as-Medical-Device, or abandon the use case.
• Scenario 4 - Procurement of vendor without ISO 42001 + Article 25(2) cooperation evidence. A new AI platform vendor lacks ISO 42001 certification, has not provided evidence of the importer-cooperation duties under Article 25(2), and refuses to make its Annex IV technical documentation available to the deployer. Criteria flagged: 6 (supply-chain breach, concentration + attestation gap + cooperation absent); 4 (regulatory readiness, TDF dependency unmet). Outcome: hard no on the procurement; either the vendor provides evidence within a defined window or the procurement is re-tendered.
• Scenario 5 - Tier 4 autonomous agent for irreversible financial actions without kill-switch drill. A proposed Tier 4 autonomous agent would execute irreversible financial transactions (settlements, payments, fund movements) without a documented kill-switch drill having been executed in production scope. Criteria flagged: 2 (AIRA breach, Tier 4 + irreversibility); 3 (capacity-to-bear breach, ALE_95 on the irreversible-loss tail); 5 (independent challenge fail, red team has flagged no kill-switch as Critical). Outcome: hard no until kill-switch drill executed and documented, and Tier 4 transition routes through AIGC with named-director ratification.
• Scenario 6 - Article 5(1)(a) social-scoring-adjacent use case. A product team proposes a customer-segmentation engine that would score customers on aggregated behavioral data including social-media signals and third-party data brokers, with the score driving service-tier access and pricing differentiation. Criteria flagged: 1 (Article 5 prohibition surfacing, social-scoring adjacency). Outcome: hard no, killed at intake; the use case is escalated to the AIGC as a teaching example of why intake screening matters and the product team is given the Article 5 reference text.
• Scenario 7 - Cross-border deployment without Schrems II + Article 9 special-category compliance. A planned deployment would process EU-resident personal data including Article 9 GDPR special-category data (health information) through a US-based foundation-model provider without Schrems II-compliant transfer mechanism and without lawful basis under Article 9(2). Criteria flagged: 6 (vendor/supply-chain, cross-border + special-category gaps); 4 (regulatory readiness, DPIA inadequate). Outcome: hard no; either restructure to EU-resident processing with attested vendor or abandon the cross-border path.
• Scenario 8 - Real-time biometric ID in public spaces. A municipal-services client requests deployment of real-time biometric identification in publicly accessible spaces. Article 5(1)(h) prohibits with narrow exemptions (targeted search for victims of specific crimes, prevention of substantial and imminent threat to life, localization or identification of perpetrators of specific serious offenses with prior authorization). Criteria flagged: 1 (Article 5 prohibition, narrow exemption only). Outcome: hard no unless the specific use case fits one of the narrow exemptions with documented prior authorization; the default is hard no.

Common Executive Failures and Cultural Patterns

Six failure modes appear repeatedly in 2026 enforcement findings, regulator informal feedback, and Internal Audit reports on AI governance say-no decisions:

• (1) CAIRO veto without documented criteria. The CAIRO says no based on professional judgment but cannot cite which of the 7 criteria are flagged or what evidence supports the flag. The AIGC discounts the veto; the CEO overrides; the CAIRO is rolled. The fix is the criterion framework, every veto carries a documented mapping; vetoes without mappings are professional objections, not formal vetoes.
• (2) CAIO bulldozes through AIGC. The CAIO uses CEO sponsorship to force AIGC approval over the CAIRO veto, bypasses Stage 4 escalation, and ratifies the deployment without proper documentation. The governance breach is structural and visible in an audit. The fix is the AIGC charter clause that requires Stage 3 → Stage 4 → Stage 5 escalation on contested criterion-triggered cases, with named-director ratification.
• (3) Board not engaged for material decisions. The CEO arbitrates a contested decision at Stage 4 without escalating to the board AI subcommittee even though the strategic implication is material. The board later discovers the decision in the post-incident review. The fix is the AIGC charter clause that names materiality thresholds, capital above €X, public-facing brand exposure, sectoral-regulator notification, Article 5 adjacency, that mandate Stage 5 escalation.
• (4) No record of yes-with-conditions follow-through. A use case is approved yes-with-conditions but the follow-through commitments are not tracked. The quarterly review does not happen; the named accountable executive moves teams; the criterion-closure metric is not measured; the sunset condition is not enforced. Drift sets in. The fix is the AIGC committee secretary's standing log of yes-with-conditions commitments with named owners and quarterly review on the AIGC agenda.
• (5) Saying no without offering alternatives. The CAIRO recommends no but offers no path to yes: no scope reduction, no control additions, no postponement, no re-framing. The CAIO labels the CAIRO "the no person." Working relationships deteriorate. Future intake processes route around the CAIRO. The fix is the Stage 1 + Stage 2 workflow expectation: the CAIRO's no must arrive with three alternatives considered (and why rejected) plus, where possible, a yes-with-conditions alternative path.
• (6) Tolerating Article 5 prohibition for short-term revenue. The use case is Article 5 adjacent; the revenue is real; the CAIO argues "the prohibition is unclear in our scenario." The CAIRO is pressured to soften the no. The Article 99(2) exposure at €35M / 7% global turnover is the existential exposure that no short-term revenue justifies. The fix is the categorical no on criterion 1; if the AIGC or CEO override, the CAIRO escalates to the board and, if necessary, exercises the resignation-and-document option to preserve personal regulatory standing.

The cultural patterns sit underneath the failure modes. The CAIRO who says yes too often loses credibility, the AIGC and the regulator both notice when the veto framework never triggers. The CAIRO who says no too often loses sponsorship, the CEO and CAIO route around the office or escalate to the board to remove the CAIRO. The CAIRO who builds documented criteria, applies them consistently, offers alternatives where mitigations exist, escalates transparently when consensus fails, and frames every no in terms of the firm's own AIRA and the board's own ratified appetite, that CAIRO builds durable authority. The 2026 CAIRO who survives the first 24 months of the role has typically said no 4-8 times in the first year, said yes-with-conditions 12-20 times, and converted the AIGC working relationship from adversarial to collaborative by month 18. The cultural patterns are not soft. They determine whether the criterion framework is operating evidence or paper.

Acme Q2 2026 Worked Example - Three Say-No Decisions in One Quarter

The Acme Q2 2026 portfolio review surfaced three contested use cases in a single quarter. The CAIRO carried three decisions through the five-stage workflow:

Decision A - Procurement agent with autonomous purchasing without budget cap. Operations team proposed Tier 4 autonomous procurement agent with €18M annual cycle-time savings business case. Stage 1: CAIRO flagged criteria 2 (Tier 4 ceiling breach), 3 (capacity-to-bear on irreversible aggregate spend), 5 (IMV Critical on tool-allowlist drift open 47 days). Stage 2: CAIRO + CAIO discussion failed to resolve, CAIO held position on Tier 4; CAIRO held no. Stage 3: AIGC split 4-4. Stage 4: CEO arbitration. CEO sustained CAIRO veto. Stage 5: not required (capital below board threshold). Outcome: approved at Tier 3 with €50,000 per-transaction human-approval gate, rolling-30-day €2M aggregate ceiling, IMV Critical closure required before any Tier 4 reconsideration, budget-cap engineering on Q3 roadmap. Documented in AIGC minutes with full criterion map. Operations team accepted the decision; cycle-time savings revised to €11M annual (still positive business case at Tier 3).

Decision B - Cross-border healthcare-adjacent deployment. Health Insurance subsidiary proposed deployment of a fine-tuned GPAI for member-health-recommendations across EU + UK + US. Stage 1: CAIRO flagged criteria 4 (no notified body engaged for medical-adjacent use under MDR), 6 (cross-border + Article 9 special-category data flow through US vendor without Schrems II mechanism), 7 (counter-positioning, public commitment to "no AI in regulated medical contexts" in 2025 ESG report). Stage 2: CAIO agreed with CAIRO veto after reviewing MDR notified-body engagement scope, the engineering effort to make the deployment MDR-compliant exceeded the business case ROI. Stage 3: AIGC ratified the postponement unanimously. Stages 4 + 5: not required. Outcome: hard no, postponed indefinitely; the use case is parked pending either MDR engagement (if Health Insurance subsidiary commits the engineering capacity) or scope reduction to non-medical wellness recommendations only (which Operations team is considering for 2027).

Decision C - Social-scoring-adjacent use case from product team. A retail-banking product team proposed customer-segmentation engine combining behavioral data + social-media signals + third-party data broker scores, with output driving service-tier access and fee differentiation. Stage 1: CAIRO flagged criterion 1 (Article 5(1)(a) social-scoring adjacency); killed at intake. Stage 2: CAIRO + product team head + CAIO joint meeting, CAIRO walked product team through the Article 5(1)(a) reference text and the Article 99(2) €35M / 7% exposure; the product team head withdrew the proposal. Stages 3 + 4 + 5: not required. Outcome: hard no, killed at intake. The CAIRO used the decision as a teaching moment at the next AI Literacy session for product managers; the AIGC ratified an intake-screening checklist update to flag any use case combining behavioral data + third-party scores + service-tier differentiation as Article 5 adjacent at intake.

The three Q2 decisions are documented in the AIGC minutes, the no-go decision memo archive, the AIRA-adherence evidence package, and the quarterly board AI subcommittee report. When the external auditor tested AIRA adherence in October 2026, the three decisions were positive findings: the criterion framework was applied consistently, the workflow was followed, the documentation was complete, and the outcomes were defensible. The auditor's report cited the Q2 decisions as evidence of operating effectiveness of the leadership commitment under ISO 42001 Clause 5 and the governance pillar under SR 11-7 + PRA SS1/23.

Key Takeaways

• "When to say no" is the hardest L5 leadership call, CEO + CAIO carry the ship mandate, the CAIRO must veto on AIRA breach / capacity-to-bear / regulatory readiness / independent challenge / Article 5 prohibition; documented board-ratified criteria are the only defense against override.
• The 7-criterion CAIRO veto framework: (1) Article 5 prohibition surfacing; (2) AIRA breach (lesson 074); (3) capacity-to-bear breach (FAIR ALE_95 + reserve, lesson 086); (4) regulatory readiness gap (FRIA, TDF, ISO 42001, GPAI obligations); (5) independent challenge fail (IMV or red-team Critical unmitigated); (6) vendor/supply-chain risk (concentration, attestation, Article 25(2)); (7) reputational/strategic counter-positioning.
• The 5-stage say-no workflow: (1) CAIRO initial assessment with criteria flagged; (2) joint CAIRO + CAIO discussion (50% resolve here); (3) AIGC escalation with formal recommendation; (4) CEO arbitration where AIGC splits; (5) board AI subcommittee or full board for material strategic implication.
• The 10-section no-go decision memo: use case + business case + AI risk assessment + criteria mapping per the 7 + alternative mitigations considered + CAIRO recommendation + CAIO response + AIGC decision + escalation + board ratification or follow-through commitments. The memo is the regulator's primary audit-trail artifact.
• The yes-with-conditions pattern resolves 1-2 criterion flags with documented follow-through (timeline, accountable executive, measurable closure metric, sunset condition); examples include hiring AI with 6-month fairness remediation deadline, credit-scoring agent with quarterly FRIA refresh, multi-agent system with quarterly kill-switch drill.
• Eight 2026 scenarios illustrate the criterion framework in operation, autonomous refund without budget cap; intersectional hiring AI fairness gap; GPAI medical fine-tune without notified body; vendor without ISO 42001 + Article 25(2); Tier 4 financial agent without kill-switch drill; Article 5(1)(a) social-scoring adjacency; cross-border special-category healthcare; real-time biometric ID in public spaces.
• Common executive failures: undocumented veto; CAIO bulldozing AIGC; board not engaged on material decisions; no follow-through on yes-with-conditions; saying no without offering alternatives; tolerating Article 5 prohibition for short-term revenue. Each failure is fixable through charter language, documentation discipline, and the 7-criterion framework applied consistently.
• Cultural truth: the CAIRO who says yes too often loses credibility; the CAIRO who says no too often loses sponsorship; the CAIRO who documents criteria + offers alternatives + escalates transparently builds durable authority. Penalty exposure: Article 99(2) €35M / 7% on Article 5 prohibition (criterion 1, the most consequential single line); Article 99(3) €15M / 3% on Article 17 + 26 + 27 + 47 + 73 failures (criteria 2 + 4 + 5 + 6).