HOA Vendor Insurance Requirements

Every other vendor-insurance guide on this site assumes the party managing the check is a business with paid staff and someone whose job title includes the word "compliance." A homeowners association is different. Most community associations in the US — and nearly all of the smaller ones — are governed by unpaid volunteer board members who serve a year or two, hold day jobs with nothing to do with risk management, and inherit whatever vendor files the previous board happened to keep. That's not a knock on how HOAs are run; it's the structural reality that makes vendor insurance a genuinely different problem here than it is for a general contractor running a jobsite or a property management company with dedicated staff.

The stakes are different too, in a specific way. When a vendor hired by an HOA turns out to be uninsured and something goes wrong, the loss doesn't land on one business's balance sheet — it lands on the association's reserve fund, and from there, potentially, on every homeowner's monthly assessment. A special assessment triggered by an uncovered vendor claim is one of the fastest ways a board loses the confidence of the community it represents.

This guide covers what a board — self-managed or working through a management company — should require from vendors, why additional insured status matters more here than the certificate-holder box most boards default to, what a real, citable case shows about the cost of skipping the check, and something almost no other vendor-insurance guide mentions: how vendor insurance connects to the association's own master policy.

The baseline for most HOA vendors mirrors what any business hiring outside labor should require: general liability, workers' compensation wherever the vendor has employees, and commercial auto for anyone driving onto association property. Insurance and vendor-compliance guidance aimed specifically at HOAs commonly sets general liability at $1,000,000 to $2,000,000 per occurrence and $2,000,000 to $4,000,000 aggregate, workers' comp at whatever the vendor's state requires, and commercial auto around $1,000,000 combined single limit. These are patterns reported consistently across multiple HOA-focused insurance and vendor-management sources, not a regulated minimum — the association's own broker should confirm the right numbers for the community's size and risk profile.

A vendor's certificate of insurance almost always lists the association somewhere — usually in the certificate holder box, because the vendor's insurance producer needs an address to mail the document to. Being listed there confers nothing. It means a copy was sent; it does not put the association inside the vendor's policy, and it does not obligate the vendor's insurer to defend or pay a claim involving the association. That distinction is covered in full in additional insured vs. certificate holder, and it's worth a board confirming it actually understands the difference, because "we're on the certificate" is the single most common false sense of security a board carries into a claim.

What actually protects the association is additional insured status, added by endorsement to the vendor's general liability policy, ideally on a primary and non-contributory basis so the vendor's policy responds first rather than splitting a loss with the association's own master policy. The endorsement should name the association's exact legal entity — the name on its articles of incorporation, not a shortened community nickname — and, where a management company handles day-to-day operations, the management company as well. That two-entity naming issue, and the completed-operations endorsement gap that matters most for the higher-risk trades named above, is covered in depth in the property management guide linked in the previous section; the same logic applies to a self-managed board acting in the management company's place.

Most vendor-insurance guidance stays abstract about consequences — "the association could be held liable" — without pointing to anything a reader could look up. One case is worth naming directly, because it involved exactly this fact pattern and the ruling is published: Heiman v. Workers' Compensation Appeals Board, 149 Cal.App.4th 724 (California Court of Appeal, Second District, 2007).

Montana Villas Homeowners Association had hired a management company, Pegasus Properties, to run its day-to-day operations. Pegasus solicited bids for a small job — installing rain gutters — and went with the lowest bid, $1,050 for two days of work, from Rubes Rain Gutter Service. Rubes turned out to be both unlicensed and uninsured. Rubes then brought in a day laborer, Freddy Aguilera, paying him $65 a day to help with the installation. On the first day, Aguilera came into contact with a high-voltage power line while handling a metal gutter and was severely injured, left 90% permanently partially disabled.

Because Rubes carried no workers' compensation insurance, Aguilera's claim for benefits had nowhere to go. California's Court of Appeal held that both the management company and the homeowners association itself were Aguilera's employers for workers'-compensation purposes, under a legal theory that treats a business exercising enough control over an uninsured subcontractor's work as a "special employer." Both were on the hook for benefits that a $1,050 rain-gutter job was never going to cover.

The takeaway isn't that every state applies this doctrine identically — special-employer and statutory-employer standards for uninsured subcontractors vary by state, and how one would apply to a specific vendor relationship is a question for the association's attorney or insurance broker, not something a guide can answer in the abstract. What the case does show, concretely, is that "the vendor is responsible for their own insurance" is not a reliable shield if the vendor turns out to have none — the exposure can land on the entity that hired them, using the same low-bid decision that made the vendor cheap in the first place.

In a professionally managed association, the management company typically operates the vendor-vetting and certificate-collection process as part of its management agreement — but "typically" is doing real work in that sentence. A board should confirm, in writing, that certificate collection is explicitly part of what the management company is being paid to do, and ask to see the current file rather than assume it exists. Who is responsible for tracking certificates of insurance covers the broader version of this problem: an unassigned responsibility is the same as no responsibility, whether the party in question is a management company or a board committee.

A self-managed association has no management company to default this task to, which means the board has to assign it explicitly — to a specific board member or committee, not to "the board" generally — and build a system that survives board turnover, since volunteer boards change every year or two and vendor files have a way of quietly disappearing between one board and the next. Without a management company tracking renewal dates, a self-managed board is also the party directly exposed to the joint-employer risk described above if a vendor turns out to be uninsured, since there's no intermediary absorbing that first layer of the relationship.

Here's a connection almost no vendor-insurance guide makes explicitly: how an association handles vendor risk can affect how its own master policy gets priced and renewed. HOA master-policy costs have been under sustained pressure through 2026 — higher reinsurance costs, rising rebuilding costs, and carriers pulling back from writing new business in catastrophe-exposed states have all been widely reported drivers of continued premium increases, in the same direction as the broader property-insurance market. None of that is unique to vendor risk, but it changes what an underwriter is looking for at renewal.

An association's broker, shopping the master policy in a tighter market, increasingly needs a straightforward answer to "how does this association handle vendor liability." A documented, consistently enforced certificate-collection process is evidence of active risk management, in roughly the same way a maintained roof or a serviced fire-suppression system is. An association that can't produce a current certificate for the roofing contractor who was just on-site looks, from an underwriter's chair, like an association that can't produce evidence of a lot of other things either. This isn't a formal underwriting requirement the way, say, a minimum roof age might be — but it's worth treating a vendor insurance program as part of the same risk-management story the master policy renewal tells, not as an unrelated line item.

Directors and officers (D&O) insurance protects board members personally against claims arising from decisions made in their capacity as board members — the good-faith judgment calls that come with volunteering to run an association. It's a different question, and a narrower one, whether D&O responds to a claim that grew out of the board simply not following a policy it had already adopted. Coverage varies by policy and insurer, and this is squarely a question for the association's own D&O carrier or broker rather than something this guide can answer generally — but a board that has adopted a vendor-insurance requirement on paper and then dispatches vendors without checking it is in a materially different position, for D&O purposes, than a board that never adopted the requirement at all.

The practical implication is simple even where the insurance answer isn't: a written vendor-insurance policy is only as protective as the board's own follow-through on it. A policy that exists on paper but wasn't actually enforced for the vendor involved in an incident shows exactly what should have been caught and wasn't — which is a worse position than not having a written policy in the first place.

The patterns that show up repeatedly when a board's vendor file is reviewed after something has already gone wrong.

Every piece of this — the right limits by vendor category, additional-insured status instead of certificate holder, an explicit owner for the file, renewal dates that don't slip between one board and the next — is a straightforward check in isolation. The difficulty, for a board with no dedicated staff and turnover every year or two, is doing it consistently without a system that survives the turnover. How to request a certificate of insurance from a vendor covers how to phrase the request so a vendor sends back a usable ACORD 25 instead of a screenshot, and the real cost of a lapsed vendor policy covers what actually gets billed, and to whom, when a lapse goes unnoticed until an incident forces someone to go looking for it.

CoverSynx gives each vendor a link to submit their certificate without creating an account, reads it, and checks it against the coverages and additional-insured status the association requires — flagging a certificate that only names the association as certificate holder, one that's about to lapse, or one that's missing workers' comp for a vendor with a crew on-site. Because it's built to run without dedicated compliance staff, it fits a volunteer board's reality better than a shared drive of PDFs that has to be manually re-checked by whoever has time that month. It assists verification; it doesn't certify coverage, and it doesn't replace a call to the association's attorney or broker on anything that looks unusual for a specific vendor. See COI tracking for HOAs for how this applies to a community association specifically.