A strong answer. “The first thing I'd do is establish what the risk actually is, in a form the business can weigh. 'This is a legal risk' is not decision-useful. 'If a German customer's employee asks for erasure and we can't do it, that's an Article 17 exposure, the realistic downside is a regulator complaint and a contractual breach with our two largest EU accounts' — that's something a VP can weigh against a launch date.

Then I'd separate the tiers, because they get conflated constantly. Some things are illegal and I will say no, clearly, once. Some things are contractual breaches of commitments we've already made, which is a business decision with a known cost. And some things are risk-tolerance questions where reasonable companies differ, and those aren't mine to decide — they're mine to make legible.

Then I'd bring an alternative. Almost always there's a version that ships on time: geofence the feature out of the EU for launch, or ship it behind a flag for design partners who've signed something specific, or ship it without the retention that creates the problem. Two weeks is enough time for a smaller version and not enough for a redesign, so the alternative has to be scoped to the calendar.

And I'd write the decision down — what the risk was, what we chose, who chose it. Not to protect myself, but because in eighteen months somebody will ask why, and an undocumented decision becomes a much larger problem during diligence than the original risk ever was.”