Certificate of Insurance (COI) Requirements in Construction: A Practical Guide

A certificate of insurance is one page of ACORD 25 that decides whether a subcontractor is allowed on a jobsite, whether their first draw gets paid, and whether the general contractor is covered if something goes wrong. It is also the compliance document that AP teams most frequently handle manually — emailed as a PDF, filed in a shared drive, checked only when the sub's first invoice lands, and forgotten until it expires mid-project.

The stakes on COI accuracy are not abstract. A missing additional-insured endorsement turns a supposedly indemnified GC into the defendant's first call when a sub's laborer is injured. A lapsed policy discovered during a claim voids coverage retroactively for the project period. A COI that looks right on the face but omits the specific wording required by the GC's contract is, in most states, no better than having no COI at all.

What a COI Actually Proves (and What It Does Not)

A certificate of insurance is evidence that a policy existed at the moment the certificate was issued. That is the entire legal weight of the document. It is not a contract, it does not amend the underlying policy, and it is not conclusive proof that coverage is in force today. The ACORD form even says so in its disclaimer text: 'This certificate does not amend, extend, or alter the coverage afforded by the policies below.'

That disclaimer is why experienced GCs require three artifacts, not just one: the COI itself, the additional-insured endorsement (an actual policy endorsement, not the COI line that says 'additional insured'), and confirmation of the waiver-of-subrogation endorsement when contractually required. The COI points to coverage; the endorsements create it.

Reading the ACORD 25 Form, Line by Line

The ACORD 25 is the industry-standard certificate form used in essentially every US construction project. Each section answers a question the GC needs to confirm before letting a sub onto the site.

Coverage Minimums — What to Require by Trade

There is no universal 'right' limit; coverage minimums should scale to project value, trade risk, and the GC's own coverage and indemnity structure. These ranges reflect widely used minimums on commercial projects and should be adjusted for high-risk trades, high-rise work, and owner-specific requirements.

Additional Insured: The Single Most Misunderstood Line

Naming a GC as 'additional insured' on a sub's policy is the mechanism that shifts defense costs and covered losses to the sub's insurer when something goes wrong on the sub's work. The COI can say 'Additional Insured: GC Name' in the description box, but the coverage only exists if the underlying policy has an endorsement creating that status.

The two endorsements to ask for by form number: CG 20 10 for ongoing operations and CG 20 37 for completed operations. Both together provide the coverage most GCs expect from a subcontractor insurance program. The older CG 20 10 11 85 form (if still in use) is the gold standard because it has the broadest scope, but modern versions (CG 20 10 04 13 and later) narrowed the coverage and should be paired with CG 20 37 for completed-operations exposure.

Waiver of Subrogation: When and Why

A waiver of subrogation prevents the sub's insurer from turning around and suing the GC to recover whatever they paid out on a claim. Without it, the sub's workers' comp carrier can pay an injured worker and then file against the GC, effectively routing the loss to the GC's coverage anyway.

Almost every commercial construction contract requires a waiver of subrogation on general liability, workers' comp, and auto. The COI should list it explicitly in the description box, and the underlying policy should have the corresponding endorsement. Workers' comp waivers of subrogation are state-specific and often require a separate state-filed endorsement.

Primary and Non-Contributory Language

When a claim happens on a sub's work, both the sub's policy and the GC's policy might respond. Without specific language, insurance law defaults to having the two policies share pro rata — meaning the GC's insurance pays part of the loss even though the sub was the one who caused it.

Primary and non-contributory language flips that default. The sub's policy pays first and in full, and the GC's policy is completely non-contributory. This is the single most important coverage enhancement a GC can require beyond the additional-insured endorsement itself.

Five COI Verification Failures That Let Non-Compliant Subs Onto the Site

Renewals and the Mid-Project Expiration Gap

A sub's policy expires exactly once per year, and on long projects, that expiration will happen mid-project. The control failure is almost always the same: no one is watching the expiration date, the renewal COI is either never collected or arrives weeks late, and the project keeps moving. If a claim occurs during the uncovered gap, the GC's risk-shifting structure is broken for that period.

The fix is expiration tracking with forward-looking alerts — 60 days before expiration to request the renewal, 30 days for escalation, day-of to block further payment or site access. The operational discipline matters more than the specific cadence; what matters is that someone is responsible and that the AP system enforces the gate.

Automating COI Verification

Manual COI verification is a labor-intensive reading exercise: open the PDF, check each coverage line, confirm expiration dates, verify the certificate holder, cross-reference against the contract requirements. A mid-sized GC might be verifying 50-200 COIs at any given time across active subs. That's why the manual process collapses first under scale.

Automated COI verification platforms read the certificate, extract every field, compare against per-contract coverage requirements, and flag discrepancies before the sub is onboarded or paid. The key features that matter in practice: form-specific extraction (ACORD 25 vs. ACORD 28 vs. international equivalents), endorsement PDF handling (not just the COI), expiration tracking with automatic renewal requests, and integration with the AP payment gate so that a lapsed COI automatically blocks further draws.

Bottom Line

COI management is a compliance discipline, not a document-filing task. The certificate itself is worth little without the underlying endorsements, the renewal cadence, and the payment gate that connects coverage status to cash flow. Every mid-market GC eventually gets burned on a lapsed COI — usually once, usually for a six-figure claim — and that's the incident that reliably drives investment in automated verification. The ones who invest first don't have the incident.