I think the biggest issue is accurately estimating the LLM failure risk, and what impacts the company is willing to tolerate in the long term. (As distinct from what the company is liable to permit through haste and ignorance.)

With LLMs the risk is particularly hard to characterize, especially when it comes to adversarial inputs.