A certificate of insurance, or COI, is a one-page proof that a vendor carries the coverage your lease or service contract requires — and “handling” one means far more than filing the PDF. It means reading the certificate, checking that the coverage limits and endorsements actually satisfy your requirement, tracking the expiration date, and chasing the renewal before the old one lapses. For a small commercial real estate firm, that job repeats across every roofer, landscaper, plumber, and cleaning crew that sets foot on a property, plus every tenant whose lease demands proof of coverage. Miss one expired COI and an uninsured contractor’s mistake can land as a claim on your policy. This is exactly the kind of low-glamour, high-consequence tracking that AI is good at — and also exactly where it quietly fails if you trust it too far. This piece explains what a certificate of insurance is, what handling one really requires, how AI does each step, and where a person still has to stay in the loop.
What a certificate of insurance actually is
A certificate of insurance is a summary document an insurance broker issues to prove that a business carries a policy. In commercial real estate it almost always arrives on a standard form — the ACORD 25, the industry certificate of liability insurance — and it lists the policyholder, the insurer, the policy numbers, the effective and expiration dates, and the coverage limits for each line: general liability, automobile, workers’ compensation, and often an umbrella or excess layer on top.
The certificate is not the insurance policy. It is a snapshot of coverage that existed on the day it was issued, produced for someone other than the policyholder — the party who wants proof. When you hire a vendor to work on a property, or sign a tenant whose lease requires coverage, you are that party. You require a COI so that if the vendor’s crew damages the building or injures someone, their insurer pays, not yours. The certificate is the paperwork that makes that risk transfer real.
Two features of the form matter more than the coverage numbers. The certificate holder box names who is receiving the proof — which should be your ownership entity, exactly as the contract requires. And the additional insured and description of operations boxes are where the endorsements live: language extending the vendor’s policy to cover you as well, waiving the insurer’s right to come after you, and stating that the vendor’s coverage pays first. Those endorsements are the whole point of requiring a COI, and they are the part everyone forgets to check.
Why COI tracking is a real job, not a filing task
At a large institution, a risk-management department owns this. At a 4–20-person firm, COI tracking usually sits on whoever runs vendor onboarding and accounts payable — the same person handling rent rolls, invoices, and owner reports. So it gets treated as a filing task: the COI comes in by email, someone glances at it, saves the PDF to a folder, and moves on. That is where the exposure builds.
A certificate of insurance has an expiration date, and coverage lapses. The roofer who gave you a valid COI in March may let the policy lapse in September and keep working your property in October with no coverage at all. Nobody re-checks, because the PDF is already in the folder. If that roofer’s crew starts a fire, the claim has nowhere to go but your own policy — and your carrier will ask, reasonably, why you let an uninsured contractor onto the roof.
The failure is almost never a dramatic one. It is a stack of small omissions: a COI that expired four months ago, a landscaper whose general liability limit is half what the contract requires, a tenant certificate that names the wrong entity as certificate holder, a vendor whose policy technically exists but never actually added you as an additional insured. Each one silently breaks the risk transfer you thought you had. This is the same pattern that makes every manual back-office loop dangerous at a lean firm — the work looks done, and the gap only surfaces when a claim or an audit goes looking. Keeping vendor paperwork current is one strand of the broader discipline our owner’s guide to property management automation lays out across the operation.
What “handling a COI” actually requires
To handle a certificate properly — not just file it — you have to run the same checklist on every one that arrives. This is the part the software ads skip, because it is the part that takes judgment.
- Read the certificate. Pull the vendor name, insurer, policy numbers, effective and expiration dates, and each coverage limit off the form. On a clean ACORD 25 this is fast; on a scanned, faxed, or hand-annotated one it is not.
- Check limits against your requirement. Your contract or lease states a minimum — say, one million dollars per occurrence in general liability, two million aggregate. The certificate’s limits have to meet or exceed it. A vendor carrying half the required limit is a vendor you are not actually protected against.
- Confirm the additional insured endorsement. The certificate must show your ownership entity added as an additional insured, usually with the endorsement form referenced in the description box. Without it, the vendor’s policy protects the vendor, not you.
- Confirm the other endorsements the contract demands. Most CRE contracts also require a waiver of subrogation (the vendor’s insurer gives up its right to recover from you) and primary and non-contributory language (the vendor’s coverage pays first, before yours). These are separate from the additional-insured status and easy to miss.
- Verify the named entity and dates. The certificate holder has to be the correct legal entity, and the policy period has to actually be current — not a certificate that was valid when issued but has since expired.
- Set the renewal chase. Log the expiration date, and before it arrives, request the renewed certificate so coverage never gaps.
Six checks, on every vendor, on every renewal, forever. Done by hand across a few dozen vendors and a portfolio of tenants, it is a standing part-time job that nobody has time for — which is why it usually does not get done. Getting vendor certificates, quotes, and follow-ups onto a repeatable track is the specific problem our vendor management framework works through end to end.
How AI handles each step
“AI handles vendor certificates of insurance” is a real claim, but it is worth being precise about which steps it handles and how. The work splits cleanly into extraction, verification, tracking, and chasing.
Extraction — reading the certificate. This is what modern document AI does best. A current-generation model can take an ACORD 25 — as a PDF, a scan, or an emailed image — and pull the structured fields off it: vendor name, insurer, policy numbers, effective and expiration dates, and each coverage limit. Where an older optical-character-recognition tool needed a fixed template and broke on any layout drift, a language model reads the form the way a person does, tolerating variation in how brokers fill it out. Extraction that used to mean re-keying every certificate by hand becomes a first pass a person reviews.
Verification — checking coverage against your rules. Once the fields are structured, the comparison against your requirement is straightforward logic: is the general liability limit at or above the contract minimum? Is the policy period current? You give the model your requirements — minimum limits per coverage line, required endorsements, the correct certificate-holder entity — and it flags each certificate as compliant or short, with the specific gap named. This is the same extract-then-check pattern that runs an automated invoice workflow, where the machine reads the document and tests it against rules you set; our explainer on how AI invoice processing works walks through that mechanism in detail.
Tracking — watching the expiration dates. With every certificate’s expiration date captured as structured data, the tracking problem becomes a calendar. Automation can maintain a live register of every vendor’s coverage status and surface the ones expiring in the next thirty or sixty days, so renewals get requested before coverage gaps instead of after a claim exposes the lapse.
Chasing — requesting renewals and fixes. The follow-up is templated communication triggered by a date or a compliance gap: a request to the vendor’s broker for the renewed certificate, or a note that the submitted COI is missing the additional-insured endorsement and needs to be reissued. A model drafts those messages against a template you approve, and the routine ones can go out on a schedule. You still decide what counts as acceptable before anyone is cleared to work.
The honest summary is that AI turns COI handling from a stack of manual re-keying and memory-based tracking into a monitored compliance loop — extract, check, track, chase — where the machine does the clerical volume and a person owns the judgment calls.
Where AI helps and where it does not
The line between what AI handles well and what it does not is the most important thing to understand before you trust it with insurance compliance.
Where it helps. Reading certificates, extracting fields, comparing hard numbers to your minimums, maintaining the expiration calendar, and drafting the chase emails — the clerical ninety percent — is exactly where automation earns its keep. This is high-volume, rule-shaped, and unglamorous, the profile of work a small team should hand off first.
Where it does not. The endorsement questions require judgment a general model cannot be trusted to make alone. Whether a specific additional-insured endorsement form actually satisfies your lease’s insurance clause, whether “blanket” additional-insured wording covers your entity, whether a waiver of subrogation applies to the right policy — these are interpretive calls where a confident-but-wrong answer is worse than no answer. A general model will also occasionally misread a figure off a low-quality scan, and it does not connect to your accounting or property-management system, so its register is only as current as what you feed it. It does not know your requirements unless you give them to it, and it cannot phone the broker to resolve an ambiguous certificate.
The workable arrangement is human-in-the-loop by design: the model does extraction, limit-checking, and tracking; a person verifies the endorsements, resolves anything ambiguous against the actual contract, and makes the final compliant-or-not call before a vendor is cleared. No certificate should clear on a model’s say-so alone. Used that way, a firm gets the speed of automation on the volume and keeps human judgment on the risk — the same balance that lets a small firm out-operate much larger institutional players on exactly this kind of detailed, consequence-heavy work.
Buy a platform or run it yourself?
Two honest paths, in the order a lean firm should weigh them.
Specialist COI-tracking platforms — myCOI, TrustLayer, Certificial, Jones, and lease-focused tools like Leasecake — are built for exactly this. They collect certificates from vendors and their brokers, extract and verify the coverage, maintain a compliance dashboard, and automate the renewal chasing. Property-management suites like Yardi, AppFolio, and Buildium also include vendor-insurance tracking as part of their vendor-management modules. The feature depth varies by product and changes with each release, so verify what a given platform actually verifies — additional-insured checking versus mere date tracking is a real difference — against the vendor’s current documentation before you buy on a demo. Market pricing for a dedicated COI platform generally runs on a per-vendor or subscription basis; the real cost is the setup and the discipline to route every certificate through it. For a firm with a large, churning vendor list, a specialist tool is often the right answer.
A general-AI first pass over the certificates you already receive is the lever most small firms overlook. The current-generation general models in ChatGPT, Claude, or Gemini can take the COIs already sitting in your inbox and folders, extract the fields, check the limits against requirements you provide, and produce a tracking register and a list of what is expiring or non-compliant — without a platform migration. The limits are the ones above: it needs your requirements spelled out, it will misread the occasional bad scan, it does not integrate with your systems, and it should never make the final endorsement call. But for a firm with a manageable vendor count and no COI system at all, it converts an untracked liability into a monitored one in a week, at almost no cost.
The honest sequence is to fix the process before buying the platform: write down your insurance requirements per vendor type, get every certificate into one place, and get your team fluent enough to run and review an extraction pass so you can see what a platform would actually replace. That fluency is a low-cost, high-return step — workshop-style training on applying these tools to CRE tasks typically sits in the low thousands, well under the cost of a single uninsured-vendor claim, while a custom automation build runs from the mid five figures up. Keeping vendor coverage current sits inside the wider back-office system — rent rolls, recoveries, payables, and reporting — that our back-office automation playbook treats as one connected operation rather than a pile of separate chores.
Frequently asked questions
What is a certificate of insurance (COI)?
A certificate of insurance is a one-page document an insurance broker issues to prove that a business carries specific coverage. In commercial real estate it usually arrives on the standard ACORD 25 form and lists the policyholder, the insurer, the policy numbers, the effective and expiration dates, and the coverage limits for general liability, auto, workers’ compensation, and any umbrella layer. It is a snapshot of coverage as of the issue date, not the policy itself, and it is produced for a party — such as a landlord or property manager — who needs proof that a vendor or tenant is insured.
How does AI handle vendor certificates of insurance?
AI handles the clerical parts of COI work in four steps. It extracts the fields off each certificate, including a scanned or emailed one, using document-reading models. It checks the coverage limits against the minimums your contract requires and flags any that fall short. It tracks every expiration date and surfaces the certificates coming due. And it drafts the renewal-request and fix-it messages to vendors and their brokers. What it does not do reliably is judge whether a specific endorsement satisfies your lease’s insurance clause — that interpretive call stays with a person.
What is an ACORD 25 form?
The ACORD 25 is the standard Certificate of Liability Insurance form used across the United States, produced by ACORD, the insurance-industry standards body. It presents a business’s liability coverage — general liability, automobile, umbrella or excess, and workers’ compensation — in a consistent layout, along with the insurers, policy numbers, dates, and limits. Because it is standardized, both people and document-AI models can read it consistently, though brokers still vary in how they complete the endorsement and description boxes.
Why does COI tracking matter for a small CRE firm?
Because a lapsed or insufficient certificate quietly breaks the risk transfer you are relying on. If an uninsured vendor’s crew damages a property or injures someone, the claim falls back on your own policy. At a small firm, COI tracking usually sits on one overloaded person and gets treated as filing rather than monitoring, so expirations slip through unnoticed. Tracking coverage as an ongoing compliance loop — not a one-time file — is what keeps that exposure closed.
What should you check on a vendor’s certificate of insurance?
Six things: that the coverage limits meet or exceed your contract minimum; that your ownership entity is named as an additional insured; that the required endorsements — typically waiver of subrogation and primary-and-non-contributory language — are present; that the certificate holder is the correct legal entity; that the policy period is current and not expired; and that you have logged the expiration to request a renewal before coverage gaps. Extraction and limit-checking can be automated; the endorsement judgment should be verified by a person.
Can AI tell if a COI meets my lease requirements?
Partly. AI can reliably check the objective parts — whether the general liability limit meets your minimum, whether the policy is current, whether the certificate holder matches. It is far less reliable on the interpretive parts, such as whether a particular additional-insured endorsement form actually satisfies your lease’s insurance clause or whether blanket wording covers your entity. Treat the model’s compliance flags as a first pass and keep a person on the endorsement questions, because a confident wrong answer on coverage is worse than a manual check.
What happens if a vendor’s insurance expires without anyone noticing?
The vendor keeps working your property with no coverage, and the risk transfer you thought you had is gone. If that vendor causes damage or injury during the lapse, their insurer has nothing to pay against, so the claim lands on your own policy — and your carrier may question why an uninsured contractor was allowed on site. This is the exact failure automated expiration tracking is meant to prevent: it flags coverage before it lapses so a renewal can be requested in time.
Should a small firm buy COI-tracking software or use a general AI tool?
It depends on vendor volume. A firm with a large, constantly changing vendor list is often better served by a specialist platform such as myCOI, TrustLayer, Certificial, or Jones, or by the vendor-insurance module in a property-management suite, since these automate collection and renewal chasing at scale. A firm with a manageable vendor count and no system at all can get most of the benefit from a general-AI pass over the certificates it already receives, at far lower cost. Verify any platform’s actual verification depth against current vendor documentation, and fix your process before buying a tool.
Does AI replace a person in COI compliance?
No. AI replaces the manual re-keying, the limit comparisons, and the expiration tracking — the high-volume clerical work. It does not replace the person who interprets whether an endorsement satisfies a contract, resolves an ambiguous certificate with the broker, and makes the final call on whether a vendor is cleared to work. The reliable model is human-in-the-loop: automation handles the volume and flags the gaps, and a person owns the judgment and the sign-off.
Where to start
Handling vendor certificates of insurance is a small, repetitive, unforgiving job — the kind that never feels urgent until an uninsured contractor turns it into a claim. The concept is simple: require proof of coverage, check that it meets your requirement, and make sure it never lapses. Turning that into a reliable, always-current process across a churning vendor list is where lean firms leak, usually because it sits on one overloaded person as a filing task instead of a monitored loop. AI closes most of that gap by taking over the reading, checking, and tracking, and leaving the endorsement judgment where it belongs — with a person.
If you are not sure where your own vendor-compliance process leaks — whether it is untracked expirations, unchecked endorsements, or requirements that were never written down — a free AI-readiness assessment gives you an honest read. It is a short working session that looks at how your COI tracking actually runs, where it slips, and what the right next step is, including whether getting fluent with the tools you already own closes most of the gap. Book a free AI-readiness assessment before you sign an annual contract for a platform you may be able to outgrow the need for.
Dirk Jan van Veen, PhD
