Vendor Insurance Requirements Review Checklist Before You Sign

Finance filed a one-page certificate and ticked insurance received. The keep / narrow / escalate log you fill before Monday: match cover to the work, match limits, dates and the Ltd, then treat the certificate as a snapshot. Open the exhibit — the attached insurance schedule — and ask for endorsements.

In August 2026, Asha — ops, 21-person UK marketplace — is told the warehouse fit-out crew starts Monday and the fulfilment SaaS goes live the same week. Finance already filed a PDF labelled Certificate of Insurance. The named insured is the contractor’s trading brand, not the Ltd on the MSA — the master services agreement. Cover listed is public liability only. The certificate expires Sunday. Typical mistake: treating the PDF as insurance done.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

Which cover types match the work, not last year’s exhibit?

Copying last year’s insurance exhibit is how a UK cleaner inherits US commercial general liability language, or a data processor gets public liability only. Write four columns: work type → required line → contract minimum → evidence seen. Match the statement of work, not the template.

Search the frozen packet — MSA, SOW, exhibits, today’s online terms — for those headings. Hiscox UK: public liability is third-party injury and property damage; professional indemnity is negligent advice. Neither is generally a legal duty. GOV.UK (Great Britain): employers with staff must hold employers’ liability of at least £5 million (1969 Act) — their floor for their staff, not your PI or cyber ask. Certificial (27 May 2026) $1 million general-liability figure is US procurement colour, not a UK rule.

• Do: write PL, EL, PI, and cyber against the actual SOW.
• Do not: paste a copied US CGL / ACORD exhibit onto an England and Wales vendor.

Do the limits, dates, and legal entity actually match?

A limit that looks fine is useless on the wrong line, under a trading name, or after the start date. The named insured must be the Ltd on the signature block — Companies House, not the brand. Dates must cover from the start of work.

Proova (1 Feb 2026): exact legal name; dates cover the engagement; limits sit next to each line. Billy (2026) review order is contract → COI → endorsements. HSE40: the EL certificate must state the minimum cover and the companies covered. For example, Asha’s fit-out PDF names a trading brand and expires Sunday — not Monday cover for the Ltd on the MSA.

• Do: match Companies House to the named insured; check per-claim versus aggregate on the right line.
• Do not: accept a certificate that expires the weekend before go-live.

Is additional insured, primary, and waiver actually endorsed?

A ticked box is not cover. On US paper, additional insured, primary and non-contributory, and waiver of subrogation are three endorsements. On England and Wales paper, look for indemnity to principals in the wording or schedule.

Insurance Curator (25 Jan 2026) (US colour): ISO CG 20 10 / 20 37, CG 20 01, CG 24 04 are US form numbers, not UK law. “As required by contract” on an ACORD 25 is informational. Riskbox: indemnity to principals is not automatic. Paterson (30 May 2026): many UK main contractors now want the certificate, the policy schedule, and indemnity-to-principals evidence. Certificate holder is not additional insured.

• Do: ask for the endorsement pages or the schedule wording that grants indemnity to principals.
• Do not: treat an ACORD checkbox as the endorsement.

Why does a certificate of insurance not equal the policy?

A certificate of insurance is a snapshot, not cover. The standard US ACORD 25 says it is issued as a matter of information only and confers no rights on the certificate holder. If the PDF and the wording disagree, the policy controls. Certificate holder is not additional insured.

The Contractor Matrix (May 2026) is the snapshot rule. The COI is not proof of cover and not a substitute for endorsements. LegalClarity is the bridge on the vendor contract red flags checklist — one row there. Indemnity is the promise; this page is the pack behind it. Open the indemnity clause review checklist for trigger and the cap stack. In practice, if the vendor will not send the schedule, log the gap and escalate.

• Do: ask for the policy schedule and the endorsements.
• Do not: tick insurance done because a PDF arrived.

When to add cyber or professional indemnity?

Public liability pays a slip-and-trip. It does not pay a negligent specification or a breach-notification bill. Add professional indemnity when they advise or design. Add cyber when they touch customer data or your systems — even if the PL number looks generous.

Insure24: software paper commonly asks for PI and cyber as contract conditions, not statute. They are different lines — negligent advice versus breach and notification costs. Asha’s fulfilment SaaS is a processor. PL-only is the wrong pack.

• Do: add PI and/or cyber when the work is advice or data, then ask for the schedule.
• Do not: accept public liability alone on a processor or an adviser.

When to calendar expiry and pause the start?

Cover that lapses the weekend before go-live is not cover for Monday. Write the start date, each policy end date, and a chase date. Many US programmes ask for 30 days’ notice — Certificial colour, not UK statute. Escalate if a required line will be dark on day one.

Pause wording Asha should circle: “Vendor shall provide a certificate of insurance; no endorsements required,” plus a COI that expires before the start date, plus no PI or cyber on a processor. Those three are a High flag — wording that should pause the start — for counsel — a qualified lawyer. Success bar: a one-page log and one date or missing endorsement that pauses Monday. Workflow: packet → match cover to work → limits/dates/entity → additional insured / primary / waiver or indemnity-to-principals → endorsements/schedule → cyber/PI if data or advice → calendar expiry → keep/narrow/escalate. Checkory can run a first-pass — a machine pass that extracts those headings. A human still matches the exhibit.

• Do: highlight one High sentence or one date, then keep, narrow, or escalate.
• Do not: tell finance the paper is closed because a certificate arrived.