How to Read an ACORD 25 Certificate of Liability Insurance

Most compliance processes treat the ACORD 25 as a pass/fail document: it arrived, it has a form number in the corner, it goes in the file. That skips the part where the form actually tells you something. Every field sits in the same place on every certificate issued in the country, because the ACORD 25 is a single standardized form maintained by ACORD, the insurance industry's data standards body — which means once you know where to look, a real check takes under two minutes.

The form itself doesn't explain any of this. There's no legend, no glossary, just abbreviated column headers written for insurance professionals — INSR LTR, GEN'L AGGREGATE LIMIT APPLIES PER, E.L. DISEASE-POLICY LIMIT. This guide walks through it box by box, in the order it appears, and covers a change to the form that took effect in December 2025 that most "how to read a COI" articles online still haven't caught up to.

ACORD released a new edition of the 25 — the 2025/12 edition — replacing the 2016/03 edition that had been the standard for almost a decade. It's a light revision on its face: an updated logo, the copyright line now reading "© 1988-2025," and a change to the wording in the certification paragraph. But that wording change matters more than the rest of the update combined.

The prior edition's certification paragraph ended with a single sentence: "LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS." The 2025/12 edition adds a second sentence after it: "LIMITS SHOWN ARE INCLUSIVE OF AMOUNTS REQUESTED BY THE CERTIFICATE HOLDER AND MAY NOT REFLECT POLICY LIMIT AMOUNTS IN EXCESS OF THOSE REQUESTED."

In plain terms: the number a producer types into the general liability limits box is no longer a reliable statement of the vendor's full policy limit. It can now be — explicitly, by the form's own wording — just the number your contract asked for, even if the underlying policy actually carries more. A vendor whose policy provides $2,000,000 per occurrence could show $1,000,000 on the certificate they sent you, because that's what your paperwork requested, and the form is now written to say that's a legitimate way to fill it out.

Industry guidance from Big I New York and the National Association of Insurance and Financial Advisors' independent-agent affiliate still recommends producers show the full policy limit regardless of what a contract requires, and most will. But "most will" isn't a guarantee, and it wasn't true before this wording existed either — the form previously implied the number shown was the policy limit; now it says plainly that it might not be. If a certificate's limit looks exactly like your contract's minimum and nothing more, that's no longer a coincidence worth dismissing — it may be precisely what the new disclaimer describes.

The top-left box identifies the producer — the agent or brokerage that issued the certificate — with a name, address, and contact details. This is the number to call if you ever need to verify the certificate, and it's worth noting for a reason covered in how to spot a fake certificate of insurance: never call the phone number printed on a certificate you're suspicious of. Look the agency up independently instead.

Beside it, the "DATE (MM/DD/YYYY)" field near the top right is the certificate's issue date — the day this specific snapshot was produced, not a policy date. The insured box below it names the business the policy actually covers, and it needs to match your contract's legal entity name exactly, not a trading name or a related company.

One field almost nobody checks is tucked into the tiny print at the bottom-left corner: the edition date, printed as "ACORD 25 (2016/03)" or, on a current certificate, "ACORD 25 (2025/12)." It tells you which version of the disclaimer language applies to the document in front of you, and a certificate still running the 2016/03 form isn't wrong — insurers have a transition period — but it does mean the limits caveat above doesn't yet apply to that specific document.

Below the insured box sits a small grid listing up to six insurers, lettered A through F, each with a NAIC number — the National Association of Insurance Commissioners' unique identifier for that carrier. It's common for a vendor to have coverage split across several insurers: general liability from one carrier, umbrella from another, workers' compensation from a state fund. Each coverage row in the grid below references back to these letters through an "INSR LTR" column, so you can tell which insurer stands behind which line of coverage.

A blank NAIC number is a legitimate reason to slow down and verify — every licensed carrier has one, and a producer who leaves it off (rather than an insurer who genuinely doesn't have a US NAIC number, which is rare but does happen with some surplus-lines carriers) is a sign the certificate deserves a closer look.

This is the row that carries the most weight for vendor compliance, and it packs in more than most people read. Two checkboxes sit at the start of the line — "CLAIMS-MADE" and "OCCUR" — and the difference between them changes what the policy actually protects against.

An occurrence policy covers an incident that happened while the policy was active, no matter when the claim is later filed. A claims-made policy only responds if the claim itself is also made while the policy is active — or during a separately purchased extended reporting period. Most general liability policies are occurrence-based, but claims-made is common for professional liability, pollution liability, and some specialty umbrella coverage. If the CLAIMS-MADE box is checked, look for the "RETRO DATE" field nearby: if that date is later than when the vendor started working for you, incidents from before the retro date have no coverage at all, even on a policy that looks current today.

Just below the checkboxes, "GEN'L AGGREGATE LIMIT APPLIES PER" offers three options: policy, project, or location. This determines whether the aggregate limit resets per job or is shared across everything the vendor does all year. A vendor juggling a dozen active contracts on a per-policy aggregate could have most of that limit already consumed by claims on other jobs you know nothing about — a per-project aggregate protects you from that, which is why it's worth requiring for any vendor whose work carries real risk.

The auto liability row only matters if the vendor drives to your site or hauls materials or equipment. Checkboxes for "ANY AUTO," "OWNED," "SCHEDULED," "HIRED," and "NON-OWNED" specify which vehicles are actually covered — a vendor who only checks "HIRED" and "NON-OWNED" has no coverage for a company-owned truck, which matters if that's what shows up on your property. The limit is either a single "COMBINED SINGLE LIMIT" figure or split into bodily injury and property damage amounts; either is normal, but a combined single limit is generally the easier one to compare against a flat requirement like "$1,000,000 CSL."

Umbrella or excess liability sits below auto, with its own occurrence-versus-claims-made checkboxes and its own each-occurrence and aggregate figures, plus a deductible or self-insured retention (SIR) field. An SIR means the vendor pays a claim themselves, up to that amount, before the umbrella responds — worth noting on a large SIR, because it functions like a gap in coverage for smaller claims even though the policy technically exists. See umbrella and excess liability for how this stacks with the underlying general liability limits.

Workers' compensation and employers' liability is its own row, split into two parts. The workers' comp side is usually just "PER STATUTE" checked, since workers' compensation limits are set by state law rather than chosen. The employers' liability side does carry chosen limits — E.L. EACH ACCIDENT, E.L. DISEASE-EA EMPLOYEE, and E.L. DISEASE-POLICY LIMIT — and if the vendor has no employees, there may be a checked "N/A" box or officer-exclusion note instead of figures, which is worth confirming rather than assuming.

Every row in the coverage grid has "ADDL INSD" and "SUBR WVD" checkbox columns, and it's tempting to treat a checked box as proof that you're an additional insured or that a waiver of subrogation is in force. It isn't. The checkbox only means the producer noted that the certificate holder requested it — the actual protection comes from an endorsement attached to the underlying policy, and the certificate is not the endorsement.

The free-text "DESCRIPTION OF OPERATIONS / LOCATIONS / VEHICLES" box near the bottom is where a careful producer writes the specifics: the endorsement form number (commonly ISO's CG 20 10 for ongoing operations or CG 20 37 for completed operations), whether the additional-insured status is primary and non-contributory, and the project or location it applies to. A checked box with nothing written in the description box is worth a follow-up question. A checked box naming "CG 20 10, primary and non-contributory, re: [your project name]" is a real answer. The full mechanics of why this distinction matters are covered in additional insured vs. certificate holder.

The certificate holder box, bottom-right, names whoever the certificate was issued to — typically your business. Being named here confirms you received a copy of the document. It confers no rights and no coverage; that's not informal guidance, it's printed directly on the form.

The bold disclaimer across the top of every ACORD 25 states it plainly: the certificate "is issued as a matter of information only and confers no rights upon the certificate holder," it does not "amend, extend or alter the coverage afforded by the policies," and it does not constitute a contract between the insurer, producer, and certificate holder. It's worth reading once in full, because it's the clearest possible statement that a certificate is evidence of a policy, not a substitute for one — the same point covered from the buyer's side in certificate of insurance vs. proof of insurance.

One more detail that catches people out: the cancellation section near the bottom no longer promises you'll be told if the policy lapses early. Current forms state that notice, if any, "will be delivered in accordance with the policy provisions" — language that shifts the obligation to whatever the underlying policy separately requires, not to you as certificate holder. In practice, that means a certificate is a snapshot of one day, and nothing on the form itself guarantees you'll hear about a cancellation the next day, or ever.

Run every incoming ACORD 25 through this before treating a vendor as compliant — it's the document-reading half of the job; the full requirements checklist covers the broader compliance decision.

The errors that turn a two-minute check into a liability discovered after the fact.

All of this is manageable for one certificate read carefully. It's a different problem across dozens of vendors, each renewing on a different date, each certificate needing the same eleven fields checked again at every renewal. That's mechanical work — how AI reads a certificate of insurance covers how automated extraction handles it — but the judgment calls (is this endorsement real, does this limit language need a follow-up call) stay human, and benefit from being surfaced instead of buried in a spreadsheet cell nobody reopens.

CoverSynx reads each incoming ACORD 25, checks the fields above against your requirements, and flags what's missing or worth a second look before a vendor is marked compliant. It assists that review — it doesn't certify coverage, and it isn't a substitute for calling the producer on anything that looks genuinely wrong.