COI Requirements by Contract Type: A Template Guide

Every vendor, subcontractor, and tenant contract needs four coverage types spelled out with specific dollar limits: commercial general liability, workers compensation, commercial auto, and umbrella. Without them in writing, you cannot enforce compliance. With them in writing but never verified, you have a paper trail showing you knew the risk and accepted it anyway. About 75 percent of vendors fail to meet insurance requirements on first submission, according to Jones compliance data. This guide covers what to require in each type of contract, how to adjust limits by risk tier, and the specific language that turns a contract clause into actual protection.

What insurance coverage types belong in every contract with a vendor?

The baseline is four coverage types. You can add more for specific risks, but these four cover the majority of claims that come through property management firms, general contractors, and facilities operations.

Commercial general liability. Standard minimum is $1 million per occurrence and $2 million aggregate. The per-occurrence limit is what the carrier pays for any single incident. The aggregate is the total cap across all claims in the policy year. A vendor with $1 million per occurrence but only a $1 million aggregate instead of $2 million has a single-claim policy. One incident exhausts it. Many smaller vendors carry $500,000 limits or single aggregates. The contract needs to specify both numbers, not just "general liability insurance required."

Workers compensation and employers liability. Workers comp at statutory limits is non-negotiable for any vendor who brings employees onto your property or jobsite. The statutory limit varies by state, and the contract should reference the state where the work is performed. Employers liability, sometimes called Part B, covers you if a vendor employee sues for injuries that workers comp does not cover. The standard minimum is $500,000 each accident. Without workers comp on the contract and verified on the COI, the general contractor or property owner can become the statutory employer of an uninsured sub injured workers. That means your insurance pays their claim, and your premiums spike for years.

Commercial auto liability. Required for any vendor who drives a vehicle to, on, or through your property. The standard is $1 million combined single limit, or CSL, meaning one number covers bodily injury and property damage together. Some contracts use split limits like 250/500/100, but CSL is simpler to verify and harder to misunderstand. If a vendor employee backs a truck into a building column, or a delivery van hits a tenant car in the parking lot, auto liability is what responds. General liability does not cover auto accidents.

Umbrella or excess liability. Sits above the primary general liability, auto, and sometimes employers liability policies. The umbrella kicks in after the primary limits exhaust. Standard minimums range from $1 million to $5 million depending on the risk tier of the work. Many institutional property owners, lenders, and municipal contracts require $5 million umbrella as a baseline. If your contract does not specify umbrella and the vendor only carries primary GL, a serious incident that exceeds the $1 million per-occurrence limit leaves you exposed for the difference.

How do insurance requirements change for different contract types?

The coverage types stay consistent across contract types. The limits, additional insured language, and special provisions change based on who is doing the work and what they are doing.

Vendor and service provider contracts

This covers janitorial, landscaping, pest control, window washing, HVAC maintenance, elevator service, and similar recurring vendors. Standard baseline applies: $1M/$2M general liability, workers comp at statutory limits, $1M auto, and $1M umbrella. The contract needs to require that your management company and the property owner are both named as additional insureds on the vendor general liability policy. For vendors doing work inside occupied units, add a requirement for completed operations coverage, ISO form CG 20 37, so you are protected if a repair fails months after the job finishes.

These vendors are typically lower risk, but the volume matters. A property manager with 30 active vendor contracts and 60 percent manual compliance has roughly 12 vendors with active coverage gaps at any moment, according to data from VendorAccess and Certificial. Each gap is a potential claim.

Subcontractor agreements

For general contractors hiring trade subcontractors, the requirements step up. General liability for medium-risk trades like electrical, plumbing, and HVAC should be $2 million per occurrence and $4 million aggregate. High-risk trades like roofing, structural steel, and demolition need the same limits plus a $5 million umbrella. The contract must require that the subcontractor names the GC and the project owner as additional insureds, with both primary and non-contributory language included. PNC means the sub policy pays first in any claim, even if the GC own insurance could also respond.

Per-project aggregate endorsements are critical in subcontractor contracts. Without one, a subcontractor working on five projects can exhaust their $2 million aggregate on three of them and have nothing left for yours. The certificate will still show $2 million aggregate. It will not tell you that $1.8 million has already been paid out. A per-project endorsement, typically ISO form CG 25 03, restricts the aggregate to each individual project. The contract needs to require this explicitly. BCS compliance data shows that 9 out of 10 submitted certificates contain errors, and aggregate issues are among the hardest to catch without systematic verification.

Waiver of subrogation on the workers compensation policy is essential in subcontractor contracts. In most states, if a subcontractor employee gets injured and the sub has no workers comp, the general contractor becomes the statutory employer. Even when the sub has comp coverage, the carrier can still subrogate against the GC if it determines the GC created an unsafe condition. The waiver blocks this. Require endorsement form WC 00 03 13 and ask for the actual endorsement page, not just a checked box on the certificate.

Tenant lease agreements

Commercial tenants doing interior buildouts, retail operations, or food service need general liability at $1M/$2M minimum, with the property owner and management company named as additional insureds. Tenants with higher foot traffic, liquor service, or hazardous materials need $2M/$4M general liability and a $5 million umbrella. The lease should also require the tenant to provide a new COI within 10 days of any policy renewal and to notify the landlord within 30 days of any coverage change or cancellation.

Tenant COIs present a different tracking challenge from vendor COIs. Vendor contracts typically run project to project with clear start and end dates. Leases run in years, and a tenant who was compliant at move-in may have let coverage lapse by year three. Lease language should include a clause allowing the landlord to purchase coverage on the tenant behalf and bill it back if the tenant fails to provide proof of insurance. This is called force-placed coverage, and while it is expensive for the tenant, it closes the gap for the landlord.

Professional services agreements

Architects, engineers, designers, consultants, and IT service providers need professional liability insurance, sometimes called errors and omissions or E&O coverage. The standard minimum is $1 million per claim and $2 million to $3 million aggregate. Professional liability is typically written on a claims-made basis rather than occurrence, which means the claim must be reported during the policy period. The contract should require that the vendor maintains coverage for three to five years after the engagement ends, through either a tail policy or an extended reporting period endorsement. If the architect design has a flaw discovered four years later, and the claims-made policy expired three years ago with no tail in place, there is no coverage.

Professional services vendors also need general liability if they visit your site, plus cyber liability coverage of at least $2 million if they access your systems or handle sensitive data. Cyber is often overlooked in professional services contracts, but if a consultant laptop with your tenant data gets stolen, general liability does not cover it.

What specific language should go into the insurance requirements clause?

Most contract insurance clauses are too vague. "Vendor shall maintain adequate insurance" is unenforceable. Adequate by whose standard? The clause needs to answer four questions with no room for interpretation.

First, what coverage types and what limits? Write out each type with both the per-occurrence and aggregate amounts. Do not reference "standard industry limits" because there is no such thing. A janitorial company and a roofing contractor have very different standards.

Second, who is named as additional insured? List the exact legal entity names. "Property owner and property manager" is not specific enough. Write the full legal name of each entity and specify the endorsement form type: "CG 20 10, Additional Insured, Owners, Lessees or Contractors, Scheduled Person or Organization, or equivalent." If you manage properties for multiple ownership entities, each one gets listed separately.

Third, what is the notice requirement? Standard language: "Insurer shall provide thirty days written notice of cancellation, non-renewal, or material change in coverage to the certificate holder." But the word "endeavor" in the ACORD 25 cancellation box means this is aspirational, not contractual. The stronger approach is to make the vendor, not the carrier, responsible for notification: "Vendor shall notify Owner and Property Manager in writing within five business days of any policy cancellation, non-renewal, reduction in limits, or change in coverage terms."

Fourth, what happens if the vendor does not comply? Spell out the remedy. Common options include: suspend work until compliant COI is received, withhold payment, terminate the contract, or purchase force-placed coverage and charge the vendor. Without a remedy clause, the requirement is a suggestion.

Sample Insurance Requirements Clause

Insurance. Vendor shall procure and maintain, at Vendor's sole expense, the following insurance coverage with carriers rated A-VII or better by A.M. Best, licensed to do business in [State], and shall name [Property Owner Entity] and [Property Manager Entity] as Additional Insureds on the Commercial General Liability policy via ISO form CG 20 10 or equivalent:

(a) Commercial General Liability with limits of not less than $1,000,000 each occurrence and $2,000,000 general aggregate, including products/completed operations, contractual liability, and personal and advertising injury coverage;

(b) Workers Compensation at statutory limits of [State], including Employers Liability with limits of $500,000 each accident, $500,000 disease per employee, and $500,000 disease policy limit, with Waiver of Subrogation via endorsement WC 00 03 13;

(c) Commercial Auto Liability with a combined single limit of $1,000,000 per accident, covering owned, hired, and non-owned vehicles;

(d) Umbrella/Excess Liability with limits of $2,000,000 per occurrence and $2,000,000 aggregate, applying excess of the General Liability, Auto Liability, and Employers Liability policies.

Vendor shall deliver certificates of insurance evidencing the required coverage to [Property Manager] prior to commencing work. Vendor shall provide renewal certificates not less than ten days prior to expiration of any required policy. Vendor shall notify [Property Manager] in writing within five business days of any cancellation, non-renewal, or material change in coverage. Failure to maintain required insurance shall constitute a material breach, and Owner reserves the right to suspend Vendor's work, withhold payment, or terminate this Agreement.

How do you calibrate limits by vendor risk tier?

A tiered system is easier to maintain than writing custom limits for every contract. Three tiers cover most situations. The exact limits adjust based on your portfolio, lender requirements, and claims history. Michigan State University, the University of Wisconsin system, and organizations like Tufts University all publish tiered vendor insurance standards that follow a similar structure. Their documents are public and worth referencing when building your own.

Coverage	Tier 1: Low Risk	Tier 2: Medium Risk	Tier 3: High Risk
Example trades	Janitorial, landscaping, pest control, office supplies	HVAC, plumbing, electrical, painting, flooring	Roofing, demolition, structural steel, crane work, hazardous materials
General Liability	$1M/$2M	$2M/$4M	$2M/$4M
Workers Comp / EL	Statutory / $500K	Statutory / $500K	Statutory / $1M
Auto Liability	$1M CSL	$1M CSL	$2M CSL
Umbrella / Excess	$1M	$2M	$5M
Additional Insured	CG 20 10	CG 20 10 + CG 20 37	CG 20 10 + CG 20 37 + PNC
Waiver of Subrogation	GL + WC	GL + WC + Auto	All policies
Specialty coverage	Not required	Site-specific	Pollution, builders risk, professional liability as applicable

These tiers are a starting point, not a final answer. Adjust them based on actual claims in your portfolio. If a specific trade has caused multiple claims in the past three years, bump it up a tier regardless of where it sits on the standard table. If your lender or insurance carrier requires higher limits than the table, their numbers override everything else. And if state law sets minimums for certain trades, those are the floor.

What role does a COI tracking system play in enforcing contract requirements?

Contract language defines the standard. COI verification enforces it. One without the other is paperwork that looks responsible and protects nothing.

Manual enforcement works at very small scale. A property manager with eight vendors can read each COI against the contract requirements, check the expiration dates, and send reminder emails. At 20 vendors, the math shifts. Data entry from a PDF certificate takes 3 to 5 minutes. Full verification of all fields against contract requirements takes another 3 to 5 minutes. At 20 to 30 certificates per month including renewals, that is 4 to 7 hours of review time. Most teams at that scale end up spot-checking. They catch the expirations, miss the missing endorsements, and have no audit trail of what was checked and when.

At 50 vendors, manual enforcement is expensive and unreliable. Organizations tracking COIs manually average 40 to 60 percent compliance at any point in time, based on data from VendorAccess and Certificial. The contract language sits in one file. The certificate sits in another. Nobody compares them systematically. Roughly 75 percent of first-submission COIs are non-compliant, and the most common failures are exactly what the contract requires but nobody verified: missing additional insured endorsements, limits below the threshold, policies that renewed without an updated certificate being requested.

COI tracking software closes the gap between contract requirements and enforcement. It reads each certificate and compares every field to the standards you define. If a vendor submits a certificate with $500,000 general liability and your contract requires $1,000,000, the system flags it automatically. If the additional insured endorsement is missing, it flags that too. If a policy is 60 days from expiration, the system sends the first renewal request to the vendor without anyone on your team opening a spreadsheet. Organizations using automated tracking average over 90 percent compliance. The same organizations manually tracking the same number of vendors average 40 to 60 percent.

COI File includes a 7-day trial after secure payment-method setup. After the trial, Base at $39/month for up to 10 vendors, Growth at $89/month for up to 50 vendors, and Pro at $199/month for unlimited vendors. The workflow uses AI-assisted extraction for ACORD 25 PDFs, supports review against the requirements you define, and sends renewal alerts at 30, 14, and 7 days. It does not replace legal review or generate a formal PDF compliance report. If you are writing good contract language and still tracking compliance manually, the contract is doing its job but the enforcement process is not. Start a trial and compare the workflow with your current process.

What are the most common mistakes in contract insurance requirements?

Five patterns keep showing up across property management, general contracting, and facilities operations. Each one looks like a minor drafting issue and creates a major coverage gap.

Vague limit language. "Vendor shall maintain commercially reasonable insurance" is the most common phrase in contracts and the most useless in claims. Commercially reasonable means whatever the vendor insurance agent thinks is reasonable, which will not match what your risk manager thinks. Write the numbers.

Missing the per-project aggregate. A subcontractor with a $2 million aggregate working on six projects can exhaust their coverage on other jobs and leave your project uncovered. The COI will show active coverage with a $2 million aggregate. It will not show that $1.8 million has already been paid. Require a per-project aggregate endorsement, ISO form CG 25 03, in every subcontractor agreement. Without it, you are betting that the sub other projects do not have claims, and you have no way to verify that bet.

Certificate holder instead of additional insured. Many contracts say "Vendor shall name Owner as certificate holder." Certificate holder status provides zero coverage. It means you receive a copy of the certificate. It does not mean you are protected by the vendor policy. The contract must require additional insured status with a specific endorsement form number. A certificate holder and additional insured are not the same thing, and confusing them in contract language guarantees confusion in enforcement.

No remedy for non-compliance. A contract that requires insurance but has no consequence for failing to provide it is a suggestion. The vendor has no incentive to comply. Include a clause that allows you to suspend work, withhold payment, or terminate. Then actually enforce it when a vendor COI lapses. A policy that exists only on paper teaches vendors that compliance is optional.

Outdated requirements from old templates. Many organizations copy insurance requirements from a contract template that was written years ago and has not been reviewed since. The limits may no longer match what the lender requires. The endorsement form numbers may have changed. The coverage types may not reflect new risks like cyber liability. Review and update your standard insurance requirements annually. If you track compliance in a system that compares COIs against requirements automatically, updating the standard is a configuration change, not a contract amendment on every active agreement. For more on building a systematic compliance program, read the COI compliance checklist for property managers.

These five mistakes are easy to fix in contract language and expensive to live with when a claim happens. A single uncovered incident costs $75,000 to $150,000 on average in direct claim payouts. If the incident involves bodily injury, settlements in slip and fall cases during coverage lapses average $750,000 to $2.3 million. Fix the contract language before you need it.

Every contract with a vendor, tenant, or subcontractor should require four coverage types as a baseline: commercial general liability at $1 million per occurrence and $2 million aggregate, workers compensation at statutory limits with employers liability of $500,000, commercial auto liability at $1 million combined single limit if the vendor drives on site, and umbrella or excess liability of $1 million to $5 million depending on the risk tier of the work. Roughly 75 percent of vendors fail to meet insurance requirements on first submission, according to Jones compliance data, and the most common reason is missing coverage types rather than insufficient limits. Specifying all four types in the contract gives you a clear standard to verify against rather than hoping the vendor knows what to include.

Low-risk vendors like office cleaning services or landscaping generally need the standard baseline: $1M/$2M general liability, workers comp at statutory limits, and auto liability if they drive on site. Medium-risk trades like HVAC, plumbing, and electrical work should add higher general liability limits of $2 million per occurrence and $4 million aggregate, plus an umbrella policy of at least $2 million. High-risk work like roofing, demolition, or structural work requires the highest tier: $2 million per occurrence general liability, $4 million aggregate, $5 million umbrella, and sometimes project-specific professional liability or pollution coverage. The Michigan State University vendor insurance guidelines and University of Wisconsin system both use a tiered approach with clear thresholds, adjust the tiers based on the claims history for each trade in your portfolio.

Certificate holder status means the vendor sends you a copy of their COI and you receive cancellation notices in theory, though carriers are not legally required to send them. It provides zero coverage under the vendor policy. Additional insured status means the vendor adds your organization to their general liability policy via an endorsement, typically ISO form CG 20 10 for ongoing operations or CG 20 37 for completed operations. If the vendor causes property damage or injury and you get sued, their insurer defends and indemnifies you. The contract must require additional insured status explicitly. A contract that only requires a COI or certificate holder status leaves you without coverage, and the certificate holder box on the ACORD 25 is not enough.

Yes, a waiver of subrogation belongs in every vendor contract, particularly on the workers compensation policy. Without it, the vendor insurance carrier retains the right to sue you to recover claim payouts if they determine you were partially responsible for an injury to the vendor employee. This happens more often than people expect. A carrier pays a workers comp claim for an injured subcontractor, then files a subrogation lawsuit against the general contractor or property owner alleging unsafe conditions. The waiver blocks this. The endorsement form number is typically WC 00 03 13 for workers compensation and CG 24 04 for general liability. Require the actual endorsement page with every COI, a checked box on the certificate is not sufficient.

For property managers, the baseline is $1 million per occurrence and $2 million aggregate general liability for most trades. High-risk trades like roofing, electrical, or HVAC work on occupied buildings should require $2 million per occurrence and $4 million aggregate. Workers compensation at statutory limits with $500,000 employers liability is non-negotiable for any vendor with employees. Commercial auto at $1 million combined single limit applies to any vendor who parks or operates vehicles on the property. Umbrella coverage of $2 million to $5 million is standard for vendors handling projects over $100,000 or working in high-occupancy buildings. Some property owners and lenders require higher minimums, check your management agreement and mortgage documents before finalizing contract language. About 40 to 60 percent of manually tracked vendor portfolios have active coverage gaps at any time, meaning the requirements in the contract are not being enforced.

General contractors have an extra layer of risk because they are often the named insured on their own policies and must also verify every subcontractor insurance. GC contracts need to require that every subcontractor names the GC and the project owner as additional insureds, not just the GC. Subcontractor limits should mirror or exceed the GC own policy limits to avoid a coverage gap where the GC umbrella has to step in. Per-project aggregate endorsements are essential for multi-job subcontractors; without one, a sub working on five sites could exhaust their aggregate on another project and leave the GC uncovered. GCs also need to require that subcontractors carry workers compensation with a waiver of subrogation, because in most states the GC becomes the statutory employer of an uninsured sub injured workers. Contract language for GCs should also include a requirement for the sub to provide updated COIs within 10 days of renewal and a clause allowing the GC to withhold payment until compliant certificates are received.

Unenforced insurance requirements in a contract are worse than no requirements at all. They create a paper trail showing you knew the risk and accepted it anyway. If a vendor without the required coverage causes an incident, plaintiff attorneys will point to your own contract language as evidence that you recognized the need for insurance and chose to proceed without it. A single uncovered claim costs $75,000 to $150,000 on average for property damage, and slip and fall settlements during coverage lapses average $750,000 to $2.3 million according to industry data. Roughly 75 percent of first-submission COIs are non-compliant, and in spreadsheet-tracked portfolios, about 30 percent of COIs are expired at any given time. Writing good contract language is step one. Enforcing it with systematic COI verification is the part that actually protects you.

References

Jones: Compliance data on first-submission COI non-compliance rates, certificate holder error frequency, and portfolio compliance benchmarks. getjones.com
BCS Compliance: Manual vs automated COI tracking comparison, 9-out-of-10 certificate error rate, aggregate limit compliance gaps. getbcs.com
Michigan State University Risk Management: Tiered vendor insurance requirements with coverage types, limits, and endorsement specifications. rmi.msu.edu
Tufts University: Vendor and contractor insurance requirements including professional liability and cyber coverage standards. access.tufts.edu
VendorAccess / Certificial: Manual tracking compliance rate data, 40 to 60 percent compliance benchmark, coverage gap frequency. certificial.com
COI Pro Track: Uncovered claim cost data, slip and fall settlement ranges, and property manager audit benchmarks. coiprotrack.com

What Is a Certificate of Insurance?: the complete beginner guide to COIs, coverage types, and how certificates work
Certificate Holder vs. Additional Insured: The Difference That Matters: why receiving a certificate is not the same as being covered
What Is Additional Insured? A Plain-English Guide: how additional insured endorsements actually work
How to Read an ACORD 25 Certificate of Insurance: field-by-field walkthrough of the standard COI form
COI Compliance Checklist for Property Managers: 7-category checklist to audit your current compliance process
COI Tracking for General Contractors: project-based subcontractor COI compliance workflows

COI Requirements by Contract Type: A Template Guide | COI File