How to Track Certificates of Insurance: 2026 Complete Guide

A Certificate of Insurance (COI) is a one-page document from a broker or carrier that proves a business currently has active insurance. It lists the insured business, the carrier, the policy numbers, the start and end dates, and the coverage limits for each type (general liability, auto, workers comp, umbrella). The standard form is called ACORD 25. The COI is just proof - it is not the policy itself, and it does not extend any coverage to you. The actual policy and any endorsements are what bind the coverage.

A Certificate of Insurance just tells you the vendor has coverage. Additional insured status is what actually extends that coverage to protect your business if something goes wrong. The COI page may show "additional insured" in the description box, but the real protection comes from a policy endorsement. For general liability, that is usually CG 20 10 (for ongoing work) or CG 20 37 (for completed work). For auto, it is CA 20 48. Good COI tracking captures both the certificate AND the endorsement.

Standard minimums for low- to medium-risk commercial vendors: General Liability $1M per occurrence / $2M aggregate; Auto Liability $1M combined single limit; Workers Comp at the state-required limit with $500K Employer's Liability; Umbrella $1M to $5M depending on contract size. Higher-risk work (construction, work at height, hot work) usually requires $2M GL, $5M umbrella, and project-specific endorsements. Always require the vendor's policy to be primary and non-contributory to yours.

ACORD 25 is the standardized Certificate of Liability Insurance form used across the United States. ACORD (Association for Cooperative Operations Research and Development) maintains the template that insurance carriers and brokers complete to issue certificates. The form has fixed sections for producer, insured, carriers, coverage types and limits, and a description-of-operations box. ACORD 25 is the default form requested when someone says "send me a COI."

COIs should be re-collected at every policy renewal - typically annually, or whenever the vendor changes carriers. Best practice is to start the renewal request at 60 days before expiration. If a vendor changes carriers mid-policy, request an updated cert immediately. If a vendor cancels coverage (rare but possible), you should be notified - which is why most master agreements require a 30-day cancellation notice provision and why some buyers use platforms like Certificial that integrate with broker management systems for live policy status.

These are standard ISO general liability endorsements that add a third party as an additional insured. CG 20 10 covers "ongoing operations" - liability for bodily injury or property damage that occurs during the work. CG 20 37 covers "completed operations" - liability that arises after the work is finished. Both are typically required in master agreements: ongoing for the project itself, completed for the years afterward when latent defects can surface. Always require both forms together if the work has any post-completion exposure.

No - and this is the most expensive mistake property managers and GCs make. A COI is a snapshot of one moment in time. Coverage can lapse, carriers can be downgraded, limits can be reduced, and endorsements can be removed. A January-issued cert may not reflect April reality. Active tracking with renewal reminders, mid-policy change detection, and continuous validation is the only way to keep risk transferred where it belongs.

"Primary and non-contributory" is contract language requiring that the vendor's insurance respond first in a covered loss, before any insurance you carry. Without this language, the vendor's policy and yours could share the loss pro-rata, defeating the purpose of risk transfer. The language appears both in the contract itself and as an endorsement on the vendor's policy. Always require both.

Three layers. First, contractually require 30-day written notice of cancellation in your master agreement and on the cert. Second, verify the vendor's broker contact and document them - the broker (not the vendor) is the source of cancellation notice. Third, for higher-risk vendors, use a platform that integrates with broker management systems (Certificial, MyCOI, ExpiryEdge's broker integrations) to receive real-time policy status updates rather than relying on the vendor or their broker to remember.

Minimum 5 years from project completion, longer for high-risk work. Latent claims - especially under completed-operations coverage - can land 3-10 years after the project ends. The certificate documents the coverage that was in force during the work, which is what your defense will rely on if a claim surfaces years later. ExpiryEdge retains all certs indefinitely with timestamped audit trails so retention is never the constraint.