You need a Certificate of Insurance from a vendor any time that vendor’s work could expose your business to property damage, injury claims, or financial loss. In practice, that covers four situations: your contract requires one, the vendor will be on your property or taking custody of your assets, a federal rule sets a minimum, or a third party like a landlord or lender demands proof before the work can proceed. Everything else is a judgment call based on how much risk the vendor actually brings through the door.
When Your Contract Requires It
The most common trigger is the contract itself. Business agreements routinely require vendors to carry specific insurance and prove it with a COI before any work starts. The contract language sets minimum coverage limits, names the required policy types, and spells out endorsements the vendor’s policy must include. Without a COI on file, you have no way to verify any of that, and if something goes wrong you’ll be arguing over coverage instead of getting a claim paid.
A standard set of contractual insurance requirements usually includes commercial general liability at $1 million per occurrence and $2 million aggregate (higher for higher-risk work), workers’ compensation whenever the vendor has employees at statutory state limits, commercial auto around $1 million combined single limit when the vendor’s vehicles are involved, and professional liability for consultants, architects, engineers, and IT providers whose errors could cause financial harm.
Contracts also frequently require the vendor to name your company as an additional insured on their policy. This is where many businesses make a costly mistake. Being listed as a certificate holder and being named as an additional insured are completely different things. A certificate holder simply receives a copy of the COI, which proves the vendor has insurance but gives you zero right to file a claim under that policy. An additional insured has actual coverage rights under the vendor’s policy and can file under it as though they were an insured party. On the ACORD 25 form, look for a mark in the “ADDL INSD” column next to the relevant coverage line. If your contract requires additional insured status and that field is blank, send the certificate back before work starts.
Additional insured coverage has limits worth understanding. The standard endorsement covers liability from the vendor’s ongoing operations, but it typically does not extend to work that has already been completed and put to its intended use. Coverage cannot be broader than what the contract requires, and it never increases the vendor’s policy limits. You share those limits with the vendor, which is why contracts with high-risk vendors sometimes require umbrella or excess liability policies on top of the base CGL.
When Vendors Work on Your Property or Handle Your Assets
Any vendor who physically enters your premises, alters your property, or takes possession of your equipment creates exposures that their own general liability policy may not fully cover. A standard CGL policy contains a “care, custody, or control” exclusion. In plain terms, the vendor’s CGL will not pay for damage to property that was in the vendor’s possession when the damage occurred. If a moving company drops your server rack, or a contractor sets fire to your warehouse while welding, the CGL may exclude the claim entirely because the property was in the vendor’s care at the time.
That gap is why a COI showing strong CGL limits can still leave you exposed for the exact scenario you’re worried about. For vendors who take custody of your assets, look for additional coverages on the certificate:
- Inland marine insurance, which covers property in transit or at temporary locations. Standard property policies generally protect assets at a fixed location but exclude items being transported.
- Installation floater or builders risk, which covers materials and equipment during construction or installation and fills the gap between the vendor’s CGL and your property policy.
- Bailee coverage, which protects property left in the vendor’s custody for service or storage, such as equipment sent out for repair.
If a vendor is leasing space from you, their policy should include coverage for damage to rented premises. The CGL form includes a limited amount of this coverage, but the default sublimit is often too low for the actual value of the space. Check that the “Damage to Rented Premises” limit on the COI matches what your lease requires.
When Federal Rules Set the Floor
Some insurance requirements are not negotiable because federal law fixes the minimums. Two areas come up most often: transportation and federal government contracting.
Interstate Motor Carriers
The Federal Motor Carrier Safety Administration requires for-hire carriers to maintain minimum liability insurance based on what they transport and the size of their vehicles. If you’re hiring a freight carrier or charter bus company, the COI should reflect at least these federally mandated limits:
- Non-hazardous freight in vehicles under 10,001 lbs GVWR: $300,000
- Non-hazardous freight in vehicles 10,001 lbs GVWR or more: $750,000
- Certain hazardous materials: $1,000,000
- Explosives, poison gas, or radioactive materials: $5,000,000
- Passenger carriers with 15 or fewer passengers: $1,500,000
- Passenger carriers with 16 or more passengers: $5,000,000
These are floor amounts, not recommendations. A carrier operating without the required coverage is operating illegally, and hiring one exposes your business to liability if something happens during transport.1Federal Motor Carrier Safety Administration (FMCSA). Insurance Filing Requirements2eCFR. 49 CFR 387.303 – Security for the Protection of the Public: Minimum Limits
Federal Government Installations
Vendors performing work on federal government property face insurance requirements under the Federal Acquisition Regulation. The FAR requires contractors to provide and maintain insurance throughout the contract and to notify the contracting officer in writing before work begins that coverage is in place. The regulation also requires that the vendor’s policy include a cancellation endorsement giving the government at least 30 days’ notice before any cancellation or material change takes effect.3eCFR. 48 CFR 52.228-5 – Insurance Work on a Government Installation
The FAR sets specific minimums for these contracts: at least $100,000 in employer’s liability, $500,000 per occurrence for general liability, and automobile liability of at least $200,000 per person and $500,000 per occurrence for bodily injury. Subcontractors working under a prime contractor on government property face the same requirements, and the prime contractor must maintain copies of all subcontractors’ proof of insurance.4Acquisition.GOV. FAR 28.307-2 – Liability
When a Landlord, Lender, or Project Owner Demands Proof
Even when your own contract does not explicitly require a COI, third parties connected to the project often do. Landlords, lenders, and project owners regularly impose insurance requirements to protect their financial interests, and they expect documentation before granting access or releasing funds.
A landlord leasing commercial space where your vendor will perform work may require proof of general liability and property coverage before allowing access. A lender financing a construction project may demand evidence that every subcontractor carries adequate coverage as a condition of continued funding. In both cases, the third party often requires that they be named as an additional insured on the vendor’s policy, not just listed as a certificate holder. If the vendor’s COI does not meet those requirements, you may face project delays, covenant violations on your lease, or a draw request that your lender refuses to fund.
When You Probably Don’t Need One
Requiring a COI from every vendor you work with is impractical for most businesses. An office supply delivery, a SaaS subscription, or a one-time catering order does not carry the same risk as a roofing contractor or a hazmat transporter. Sorting vendors into risk tiers and matching your insurance requirements accordingly is the sensible approach.
High-risk vendors work on your property, operate heavy equipment, handle hazardous materials, transport valuable goods, or access sensitive data. They need full COIs with strong limits, additional insured endorsements, and waivers of subrogation. Medium-risk vendors provide professional services off-site, deliver goods to your location, or perform light maintenance; a COI confirming standard CGL and workers’ compensation is usually enough. Low-risk vendors have minimal physical or financial contact with your operations. Major carriers like FedEx and UPS are already licensed under Department of Transportation rules that mandate specific insurance limits, so requiring a separate COI from them is redundant and slows down routine operations.
The dividing line is exposure. If the vendor’s negligence could generate a claim against your business, you need the COI. If the vendor has no meaningful access to your property, people, or data, the administrative cost of tracking their insurance probably outweighs the risk.
What to Check Once You Have the COI in Hand
Requiring a certificate is only useful if it actually confirms the coverage you need. Nearly every COI you receive will be an ACORD 25 form, a standardized one-page document created by the Association for Cooperative Operations Research and Development.5ACORD. Certificates of Insurance FAQ A few fields do most of the work:
- Insured name and address should match the vendor’s legal business name in your contract, not an individual’s name.
- Every coverage line should have a policy number, an effective date, and an expiration date. Blank policy numbers are a red flag.
- Coverage limits should meet or exceed what your contract requires. Check whether the general aggregate applies per project or per policy, since a per-policy aggregate can be partially depleted by claims from other projects.
- The “ADDL INSD” and “SUBR WVD” columns should show marks wherever your contract requires additional insured status or a waiver of subrogation.
- The Description of Operations box should reference your specific project or contract and confirm any special endorsements.
Two coverage details deserve separate attention. First, check whether general liability and professional liability are written on an occurrence basis or a claims-made basis. An occurrence policy covers any incident that happens during the policy period, regardless of when the claim is filed. A claims-made policy only covers claims that are both made and reported while the policy is active. For work where problems might not surface for months or years, occurrence coverage is far more protective; if the vendor carries claims-made, your contract should require tail coverage for a specified time after work is completed.
Second, look for a waiver of subrogation on any coverage line where your property or operations intersect with the vendor’s work. Without the waiver, the vendor’s insurer can pay a claim and then sue you to recover the money, arguing that your negligence contributed to the loss. The waiver appears in the “SUBR WVD” column and, if your contract requires it, that column should not be blank.
One thing the ACORD 25 does not do: it does not change the vendor’s insurance policy. The form itself says so in its disclaimer. A COI is a snapshot on the date issued. If the vendor cancels or reduces coverage the next day, the certificate is worthless, which is why updated certificates should be requested well ahead of each policy’s expiration.
What It Costs to Skip This
The consequences of not collecting a COI range from inconvenient to devastating, depending on what goes wrong and how much the vendor’s missing coverage was supposed to cover.
The most immediate hit is financial. If a vendor causes injury or property damage and has no insurance, the injured party’s attorneys look up the chain for someone who can pay, and your business becomes the target. Even if you have your own liability coverage, your insurer may dispute the claim on the grounds that you failed to verify the vendor’s coverage as required by your own policy terms. You could end up paying defense costs and settlements out of pocket.
Workers’ compensation audits catch many businesses off guard here. When your insurer audits your workers’ comp policy, they review payments made to subcontractors and request certificates for each one. If a subcontractor cannot produce a valid workers’ comp certificate, the auditor treats those payments as payroll and charges you additional premium accordingly. In most states, if an uninsured subcontractor’s employee is injured on the job, the worker can seek benefits under your policy as the hiring company.
In regulated industries, the consequences go beyond money. Hiring an uninsured vendor can trigger fines, project shutdowns, or loss of your own professional license. Indemnification clauses in your contract with the vendor are cold comfort if the vendor lacks the financial resources to honor them. The point of requiring the COI is to confirm that an insurance company stands behind the vendor’s obligations, not just the vendor’s promise.