How Long to Keep Certificates of Insurance: A Retention Guide

Last updated July 2026.

Keep a certificate of insurance for as long as a claim arising from that vendor's work can still be brought against you, not for as long as the policy was in force. For most US businesses that means five to seven years after the contract ends. For construction work with completed operations exposure, it can mean a decade or more, because your state's statute of repose, not the certificate's expiration date, controls the clock.

This trips people up because a certificate looks disposable. It expires, a new one arrives, and the old one goes in the recycling. Then a slip and fall from four years ago turns into a lawsuit, your carrier asks for proof that the janitorial contractor carried general liability with you named as additional insured on the date of the incident, and the only copy of that certificate left the building with the shredding vendor.

Retention is a separate question from validity. If you are asking how long a certificate stays current, that is how long certificates of insurance are valid. This page is about how long you keep the paper after it stops being current.

How long should you keep certificates of insurance?

Keep each certificate for at least the length of your state's statute of limitations for contract and liability claims, measured from when the work ended. In practice most risk teams settle on five to seven years as a floor. Construction, healthcare and anything involving bodily injury to a minor commonly runs longer, and some organizations keep certificates permanently because storage is cheap and a missing one is not.

Why the expiration date on the certificate is not a retention date

The expiration date tells you when the underlying policy period ends. It says nothing about how long you might need to prove that coverage existed. Those two dates are unrelated, and confusing them is the single most common retention mistake.

Think about what a certificate is actually for. It is evidence, on a specific date, that a specific vendor carried specific coverage with specific limits, and that you were named the way your contract required. The day you need that evidence is the day someone sues you for something that vendor did. That day arrives years after the certificate expired, which is exactly when the document is most valuable and most likely to have been thrown away.

How long should a general contractor keep subcontractor COIs?

Longer than almost anyone else. Completed operations exposure means a subcontractor's work can produce a claim years after the project closes out, and the general contractor is usually named alongside the sub. Keep subcontractor certificates and the additional insured endorsements for the full length of your state's statute of repose for construction defect, which commonly runs somewhere between roughly four and fifteen years depending on the state.

Because that range is so wide, the practical answer most construction risk managers reach is to keep subcontractor certificates permanently. The storage cost of a PDF is effectively zero. The cost of not being able to tender a defense to the sub who actually caused the defect is the entire claim. If you are not sure why this coverage outlives the job, read what completed operations coverage is, and check the specific numbers for your state with counsel rather than relying on a rule of thumb.

Do you need to keep expired certificates of insurance?

Yes, and expired certificates are the ones that matter most. A current certificate proves a vendor is covered today, which is useful for letting them on site. An expired certificate proves the vendor was covered on the day of an incident, which is what wins or loses a claim. Deleting expired certificates destroys the only proof you had.

The mental model that helps: current certificates are an access control tool, expired certificates are a legal record. They serve completely different purposes and only one of them has an end date.

How long should I keep insurance papers?

It depends on which paper. A vendor's certificate, your own policy, a claims file and a workers compensation record all run on different clocks, and treating them as one category is how retention policies go wrong.

Document	Common retention practice	Why
Vendor certificate of insurance	5 to 7 years after contract ends, minimum	Covers the usual statute of limitations for contract and liability claims
Subcontractor COI with completed operations	Statute of repose, often kept permanently	Construction defect claims surface many years after closeout
Additional insured endorsement	Same as the certificate it supports	The endorsement, not the certificate, is what actually grants coverage
Your own liability policies	Permanently, per common risk management guidance	Occurrence policies can be triggered decades later
Claims made policies	Roughly 6 years after the tail expires	The reporting window, not the policy period, ends the exposure
Workers compensation records	Indefinitely, in common practice	Occupational disease claims can arise long after employment ends

These are the retention periods that show up consistently across broker and risk management guidance, not legal requirements. Statutes vary by state and by claim type, and some industries carry their own record rules on top. Set your policy with counsel and then apply it consistently, because an inconsistent retention policy is worse in litigation than a short one.

What about workers compensation certificates?

Hold them indefinitely. Occupational disease and repetitive injury claims can be filed many years after the exposure, and if an uninsured subcontractor's employee is later reclassified as your employee in a premium audit, the certificate you collected is the document that shows you did your part. Workers compensation is the one line where nobody sensible sets a deletion date.

What actually drives the retention clock

Two legal concepts do most of the work, and they are not the same thing.

A statute of limitations starts when a claim is discovered or when an injury occurs, and it defines how long the injured party has to sue. A statute of repose starts when the work was substantially completed and cuts off liability entirely after a fixed period, whether or not anyone has discovered the problem. Repose is the one that matters for construction, and it is why a subcontractor certificate from a project that closed in 2019 can still be the most important document in a 2029 lawsuit.

Both vary by state. Neither has anything to do with when the certificate expired.

Can you store certificates of insurance digitally?

Yes. There is no requirement that a certificate be retained on paper, and a searchable digital archive is far more defensible than a filing cabinet, because you can actually produce the right document when it is requested. What matters is that the record is complete, unaltered and retrievable by vendor and by date.

If you are starting from a decade of paper in storage, the work is scanning and then getting the data off the page, and there are tools that will pull structured data out of scanned documents at volume rather than making someone retype it. Once the archive is digital, the retention policy becomes a field on a record instead of a box on a shelf.

A retention policy you can actually run

The policies that survive are short. Four decisions cover most organizations.

First, decide the floor. Pick a minimum retention period for all vendor certificates, seven years is a defensible common choice, and apply it to everything so nobody has to make a judgment call on a Tuesday afternoon.

Second, carve out construction. Subcontractor certificates and their endorsements do not get deleted, because the repose clock is too long and too variable to manage per vendor.

Third, keep the endorsement with the certificate. A certificate is evidence that a policy existed. The additional insured endorsement is the thing that actually extends coverage to you. Storing the first without the second gives you a document that proves almost nothing when it counts.

Fourth, stop deleting things manually. Every retention failure in practice comes from a human deciding a folder looked old. A COI tracking system keeps every version of every certificate against the vendor record, so the historical certificate is retrievable by vendor and date without anyone maintaining an archive. That is also the difference between answering a carrier's document request in ten minutes and spending a week in a storage unit.

The bottom line

Certificates expire. Liability does not, at least not on the same schedule. Keep every certificate for at least five to seven years after the contract ends, keep subcontractor certificates and endorsements for as long as your state lets a construction defect claim be brought, keep workers compensation records indefinitely, and never let the expiration date on a certificate be the trigger for deleting it.

The organizations that get audited badly are not the ones that kept too much. They are the ones that kept a current certificate for every vendor and could not produce a single expired one. Keeping the history is the entire point of certificate of insurance management software, and if you are a general contractor the specific workflow is covered in COI tracking for general contractors.

PDF, JPG, PNG, BMP, HEIC, TIFF