How to Read a Certificate of Insurance (ACORD 25): A 2026 Guide

A vendor just handed you a certificate of insurance, and you're staring at a dense, one-page form packed with codes, abbreviations, and tiny boxes. You know it matters, but you're not sure what you're looking at or what could go wrong if you miss something. The ACORD 25 certificate of insurance is the standard proof-of-coverage document used across nearly every industry in the United States, yet most people who receive one don't know how to verify what it actually says. That's a problem, because a misread or fraudulent COI can leave your business exposed to six-figure claims.

This guide breaks down each section of the ACORD 25 form so you can read it with confidence, verify the details that matter, and catch red flags before they cost you money. Whether you're a property manager collecting certificates from contractors, a general contractor reviewing sub coverage, or a business owner onboarding new vendors, you need to know exactly what this form tells you and, just as important, what it doesn't. If you've ever wondered whether your vendor's coverage is real, current, and sufficient, you're in the right place.

The ACORD 25 is a standardized form, but it's often misunderstood. Before you can read one effectively, you need to know what it is, what it isn't, and where its limitations lie.

What is an ACORD 25 Form?

The ACORD 25 is a standardized certificate of insurance form created by the Association for Cooperative Operations Research and Development. It serves as a snapshot of an insured party's coverage at a specific point in time. The form consolidates key details from multiple insurance policies onto a single page: policy numbers, coverage types, limits, effective dates, and the names of the insured and the insurer.

Nearly every industry uses this form. When a general contractor hires a subcontractor, they'll request an ACORD 25. When a property owner leases commercial space, they'll ask the tenant for one. The form itself is issued by the insured's insurance agent or broker, not by the insurance carrier directly. This distinction matters, as we'll discuss later.

The Difference Between a COI and an Insurance Policy

A COI is not a contract. This is the single most important thing to understand. The ACORD 25 is an informational document only. It doesn't grant rights, extend coverage, or modify policy terms. The actual insurance policy, which can run hundreds of pages, is the binding legal document.

Think of the COI as a receipt that confirms coverage exists. It tells you what policies are in force and their limits, but it can't tell you about exclusions, conditions, or endorsements buried in the policy itself. If a contractor hands you a COI showing $1M in general liability, that doesn't mean every type of claim is covered up to $1M. Specific exclusions in the policy could leave major gaps. This is why firms like Fusco Orsini & Associates often recommend requesting copies of relevant endorsements alongside the certificate itself.

The form is divided into distinct blocks. Once you know where to look, reading a certificate of insurance becomes straightforward.

Producer, Insured, and Insurer Information

The top-left corner identifies the producer, which is the insurance agency or brokerage that issued the certificate. The insured's name and address appear just below. On the right side, you'll find the insurer(s) listed with letter designations (Insurer A, Insurer B, etc.) that correspond to specific policies in the coverage block below.

Pay attention to the insured's name. It should match the legal entity you're doing business with. If your contract is with "Smith Construction LLC" but the COI lists "Smith Construction Inc.," that's a discrepancy worth flagging. Also verify that the insurers listed are admitted carriers in your state, or at minimum, financially stable. You can check insurer ratings through AM Best.

Decoding the Coverages Block

The middle section of the form is where most of the critical information lives. Each row represents a different type of coverage: commercial general liability, automobile liability, umbrella/excess liability, and workers' compensation are the most common.

Each row includes the insurer letter (linking back to the insurer block above), the policy number, the policy effective and expiration dates, and the limits of insurance. You'll also see checkboxes and codes. For general liability, look for "OCCUR" (occurrence-based) versus "CLAIMS-MADE." Occurrence policies cover incidents that happen during the policy period regardless of when the claim is filed. Claims-made policies only cover claims filed during the active policy period, which creates potential gaps if coverage lapses.

Policy Limits and Effective Dates

Limits are displayed in a column on the right side of each coverage row. For general liability, you'll typically see per-occurrence limits, general aggregate limits, and products/completed operations aggregate limits. A common configuration is $1M per occurrence with a $2M general aggregate.

Don't just check that limits exist. Verify they meet your contract requirements. If your lease or subcontract requires $2M per occurrence and the COI shows $1M, the vendor is underinsured for your purposes. Also confirm the policy dates. A certificate showing a policy that expired last month is worthless. California contractors, for example, face specific insurance cost structures that influence the limits they carry, so regional expectations vary.

Comparison Chart: General Liability vs. Professional Liability

These two coverage types are frequently confused, but they protect against very different risks.

If you're hiring a consultant or IT managed service provider, don't assume their general liability policy covers bad advice or a data breach. You need to see professional liability listed separately.

The COI verification process has grown more complex over the past few years, driven by regulatory changes and a sharp rise in document fraud.

Checking for Additional Insured Status

One of the most requested endorsements in commercial contracts is "additional insured" status. This means your company is added to the vendor's policy as a protected party. If a claim arises from the vendor's work, you're covered under their policy.

On the ACORD 25, look at the "Description of Operations / Locations / Vehicles" box near the bottom. You should see language like "Certificate Holder is included as Additional Insured" along with a reference to the specific endorsement form number (e.g., CG 20 10 or CG 20 37). If this box is blank or contains only generic project descriptions, don't assume you're covered. Request a copy of the actual additional insured endorsement from the agent.

Waiver of Subrogation and Primary/Non-Contributory Clauses

A waiver of subrogation prevents the vendor's insurer from pursuing your company to recover claim payments. Without it, you could pay out on a claim and then get hit with a subrogation demand from the vendor's carrier. This should also be noted in the Description of Operations box.

Primary and non-contributory language means the vendor's policy pays first, before your own insurance is triggered. This is standard in most construction contracts and many commercial leases. If your contract requires these provisions, confirm they appear on the certificate. A missing waiver of subrogation or primary/non-contributory clause is one of the most common compliance gaps that Fusco Orsini & Associates identifies during client coverage reviews. Certificate tracking is often the biggest security gap in vendor risk management programs.

Spotting Fraudulent or Expired Certificates

COI fraud is a growing problem. AI-powered editing tools have made it disturbingly easy to alter policy numbers, dates, and limits on a certificate. The National Insurance Crime Bureau has flagged that AI editing tools are fueling a new era of insurance fraud, with doctored certificates becoming increasingly common in construction and real estate.

Here's how to protect yourself. Call the producing agent directly using a phone number you find independently, not one listed on the certificate. Verify the policy number, dates, and limits. Cross-check the insurer's name against your state's department of insurance database. Watch for visual inconsistencies: misaligned text, different fonts, or pixelation around numbers. Using unapproved or outdated COI forms in states like New York can carry penalties ranging from $1,000 to $2,500, so form compliance matters on both sides of the transaction.

Common Questions from Business Owners and Contractors

Does a COI guarantee I'm covered if something goes wrong? No. A COI is informational only. It confirms that policies existed at the time of issuance but doesn't modify or extend coverage to you. Only the actual policy and its endorsements determine coverage.

How often should I collect updated certificates from vendors? At minimum, annually and whenever a policy renews. Set calendar reminders 30 days before expiration dates listed on existing certificates. Automated tracking platforms can simplify this process significantly.

Can a policy be canceled after a COI is issued? Yes. The "Cancellation" section on the ACORD 25 states that the insurer will endeavor to mail notice if a policy is canceled, but there's no guarantee you'll be notified. This is another reason to verify coverage independently and regularly.

What's the difference between ACORD 25 and ACORD 28? The ACORD 25 covers liability policies. The ACORD 28 is used for property coverage, typically for evidence of commercial property insurance. If you're a landlord requiring tenant property coverage, you'll want an ACORD 28 in addition to the ACORD 25.

Who is responsible for issuing the certificate? The insured's agent or broker issues the COI, not the insurance company. The certificate holder (you) requests it, but you receive it from the producer.

Should I accept certificates from unfamiliar insurance companies? Check the insurer's AM Best rating and confirm they're authorized to write coverage in your state. An unfamiliar name isn't automatically a red flag, but an unrated or non-admitted carrier in a state that requires admitted coverage is a concern.

Reading an ACORD 25 certificate of insurance isn't just an administrative task. It's a risk management function that directly affects your financial exposure. Every blank box, missing endorsement, or expired date represents a potential gap that could leave you holding the bag on a claim.

Build a simple checklist based on the sections above: verify the insured's legal name, confirm coverage types and limits match your contract requirements, check for additional insured and waiver of subrogation language, and validate dates. Make it a standard part of your vendor onboarding process.

If you're unsure whether your current certificates meet your contractual and regulatory requirements, a coverage review with an experienced agency like Fusco Orsini & Associates can identify gaps before they become claims. The few minutes you spend reading a COI correctly today can save you from a costly surprise tomorrow. Don't file it. Read it.