What a Certificate of Insurance Actually Proves

What it does establish

A certificate is a statement by the issuing agent or broker that, on the date it was issued, certain policies existed with certain numbers, carriers, coverage types, limits and effective dates. That is genuinely useful. It is enough to tell you whether a vendor carries general liability at all, whether the stated limits clear your threshold, and whether the policy period covers the work you are about to authorize.

For a routine, low-exposure vendor, that is usually proportionate evidence. Most of commercial onboarding runs on certificates for exactly this reason and is not wrong to.

What it does not establish

That the policy is still in force. A certificate is a snapshot. A policy canceled the day after issue produces no change to a certificate already sitting in your file. The cancellation-notice language on the form obliges the insurer to nothing it has not separately agreed to. For workers' compensation, some states let you check this yourself: Texas (TDI's coverage verification, through TXCOMP) and Georgia (the State Board of Workers' Compensation's online verification) publish free lookups of an employer's coverage on file with the state.

That you have any rights under the policy. ACORD 25 says on its own face that it is issued as a matter of information only and confers no rights on the certificate holder. Coverage for you comes from an additional insured endorsement, not from the certificate — see Certificate Holder vs Additional Insured.

That the coverage has no exclusions that matter to you. The form has room for coverage types and limits, not for the exclusions, sublimits, retentions and endorsements that determine whether a specific claim is actually paid. Two certificates showing identical limits can sit on top of very different policies.

That the remaining limits are what it says. Limits shown are per-policy, not per-you. An aggregate substantially eroded by earlier claims still prints at its full face value.

So what is the certificate check actually for?

It answers one question well: does the coverage this vendor says they carry meet the requirements we wrote down? That is a comparison between a stated summary and a stated threshold, and it is genuinely mechanical.

It is the wrong instrument for "is this vendor adequately insured for this risk", which is a judgment about exclusions, claims history and the shape of the work — a broker's question, not a form's.

Most onboarding failures come from asking the second question and accepting the first question's answer.

Proportionate evidence

A sensible policy escalates with exposure rather than treating every vendor identically:

Routine vendor, low exposure. The certificate, checked against your thresholds, is proportionate.

On-site work, contractual indemnity, or a long relationship. Add the additional insured endorsement itself, and confirm whether completed operations are included.

Material exposure. Ask for the policy or a broker's letter. At that level the certificate is a cover sheet for the evidence, not the evidence.

The one thing worth being strict about

Whatever depth you choose, the record should distinguish three different states, because they call for three different actions:

Checked and met. The value was read and it cleared your threshold.

Checked and not met. The value was read and it did not. Go back to the vendor.

Not established. The field was blank, illegible, or never evaluated. Go back to the document — and do not let this become the first state by default.

The third one is where automated review quietly goes wrong. A field that could not be read and a field that was read as absent produce the same null, and a system that records both as "not shown" has manufactured a finding about a vendor's insurance that nobody actually verified. An absence of checking is not an absence of findings.

Checking this automatically

The comparison in section three — stated coverage against written thresholds — is the part that can be mechanized honestly. The COI / ACORD 25 Verification API returns a verdict against your own requirements, an itemized list of what failed, the list of rules it actually evaluated, and — separately — every value it could not read. The last two are what let you tell a clean result from a check that never ran.

Does it detect a forged or altered certificate? No: it reads what the certificate prints, so a forged or edited certificate that prints passing values reads as compliant.

Or try it on a real certificate right now, free and without signing up: the COI checker runs the same code this API does, including the part that tells you which fields it could not read.

And if you would rather test this than take our word for it: the COI Extraction Honesty Test is an open, synthetic test set for exactly this failure — four documents, documented ground truth, free to run against any tool.

Related reading: What Makes a Certificate of Insurance Deficient and When a Certificate Can't Be Read.

This is not legal or insurance advice

What a particular certificate proves about a particular contract depends on that contract and that policy. This page explains what the form is and what it is not. Aervik Labs is operated by EAC Ventures, LLC and does not give legal, insurance, or risk advice — consult your broker or counsel for your actual obligations.