What Does a Certificate of Insurance Cover?

Last updated July 2026.

A certificate of insurance does not provide any coverage at all. It is a one-page snapshot proving that policies exist, showing the insurer, policy numbers, coverage types, limits, and effective dates as of the day it was issued. The actual coverage lives in the policy. The certificate is evidence of it, and the ACORD 25 form says so in its own disclaimer.

That distinction sounds pedantic until it costs someone a claim. Plenty of businesses collect certificates believing the document itself confers protection, then discover during a loss that the endorsement they assumed was in place was never added to the policy. Understanding what a COI does and does not cover is the difference between collecting paper and actually being protected.

What a certificate of insurance shows

A standard ACORD 25, the form used for almost all US commercial certificates, lays out the same information in the same places:

The coverage types you will see on the grid

These are policies the vendor carries. The certificate reports their limits; it does not create them.

• Commercial general liability. Third-party bodily injury and property damage. The most-required coverage on almost any vendor contract. Watch the per-occurrence limit, the general aggregate, and whether the aggregate applies per project.
• Automobile liability. Vehicles used for the business. Check whether it covers any auto, or only owned, hired, and non-owned vehicles.
• Umbrella or excess liability. Sits above the underlying policies to raise effective limits. Confirm which policies it actually sits over.
• Workers compensation and employers liability. Employee injury. This is the one that carries a specific extra risk for you: if your subcontractor lacks it, an audit can reclassify their workers as your payroll.
• Professional liability. Errors in professional services. Required for design, consulting, engineering, and IT vendors.
• Pollution liability. Environmental releases. Common for waste, fuel handling, and environmental contractors.

What a certificate of insurance does not cover

This is the part that matters most, and it is where most vendor compliance programs have their real gap.

It does not give you rights under the policy

Being listed as the certificate holder means you received a copy of the certificate. Nothing more. To actually have rights under the vendor's policy, you must be added as an additional insured by endorsement to the policy itself. Certificate holder and additional insured are frequently confused, and the confusion is expensive.

It does not prove the policy is still in force

A certificate is accurate on the date it was issued. A policy can be cancelled the next day for non-payment. The cancellation notice language on the ACORD 25 was narrowed years ago and typically obliges the insurer only to follow the policy provisions, not to notify you. A certificate from March tells you very little in September.

It does not amend or extend the policy

The ACORD 25 states plainly that the certificate confers no rights, and that it does not affirmatively or negatively amend, extend, or alter the coverage in the policies. If the description of operations box says a waiver of subrogation applies but no waiver endorsement was added to the policy, the box is wrong and the policy governs.

It does not tell you about exclusions

This is the largest blind spot. A general liability policy can show a 1,000,000 dollar limit and carry exclusions that gut it for your specific exposure: residential construction exclusions, height or depth limits, subcontractor warranty conditions, assault and battery exclusions for security work. None of those appear on the certificate. Only the policy shows them.

So what should you actually verify?

Given the limits above, a useful vendor insurance check has four steps rather than one.

1. Read the grid against your requirement. Confirm each required coverage is present and each limit meets or exceeds the contract minimum. This is where most short limits get caught.
2. Confirm the endorsements exist, not just the wording. If your contract requires additional insured status, primary and non-contributory wording, or a waiver of subrogation, ask for copies of the endorsement forms. Certificate language is a claim; the endorsement is the evidence.
3. Check the dates, then check them again later. A certificate is a point-in-time document. Track the expiration and re-collect before it passes.
4. Verify the certificate is genuine. COIs are trivially editable as PDFs, and altered certificates do circulate. Confirming coverage with the issuing agent is the reliable check.

Vendor insurance is one obligation among several most companies have to evidence continuously, alongside licensing, security attestations, and the controls a customer audit will ask you to demonstrate. The common failure across all of them is the same: collecting a document once and treating it as permanent proof.

Frequently asked questions

What does a certificate of insurance cover?

A certificate of insurance covers nothing by itself. It is proof that specific insurance policies existed on the date it was issued, listing the insurer, policy numbers, coverage types, limits, and effective dates. The coverage is provided by the underlying policies, and the certificate is only evidence that those policies were in force.

Does being a certificate holder mean I am covered?

No. Certificate holder status only means the certificate was issued to you. It grants no rights under the vendor's policy and no ability to make a claim on it. To have rights, you must be named as an additional insured by an endorsement added to the policy itself, which is a separate step your contract should require.

What limits should I require on a certificate of insurance?

Common US commercial baselines are 1,000,000 dollars per occurrence and 2,000,000 dollars general aggregate for general liability, 1,000,000 for auto liability, and statutory workers compensation with 1,000,000 employers liability. Higher-risk work such as height, excavation, or hazardous materials typically warrants more, often through an umbrella policy. Set the limit in the contract, not on the certificate.

How long is a certificate of insurance valid?

A certificate is valid until the expiration date of the underlying policy shown in the coverage grid, most often one year from the effective date. It can become inaccurate sooner if the policy is cancelled or changed, since the certificate is not updated when that happens. Our guide to how long certificates of insurance stay valid covers this in detail.

Can a certificate of insurance be faked?

Yes. A COI is a PDF, and limits, dates, or endorsement language can be altered with ordinary editing tools. Altered certificates turn up most often when a vendor's coverage has lapsed or falls short of a contract requirement. Verifying directly with the issuing agent or broker is the dependable check.

The short version

Treat a certificate of insurance as a receipt, not a shield. It tells you which policies existed on one specific day and roughly what they were worth. Your protection comes from requiring the right coverage in the contract, confirming the endorsements were actually added to the policy, and re-verifying before the certificate goes stale. For the operational side of doing that across every vendor, see how to read a certificate of insurance line by line and certificate of insurance verification.