What should an agency test first when it tries AI on certificates?

When an agency says it wants to try AI on certificates, it usually means one of three jobs. Issuing: a holder or an insured asks for a certificate, and someone produces it from the policy. Checking: the request arrives with a contract, and someone reads its insurance section against the policy before anything is issued. Tracking: certificates come in from other agencies, usually for an insured's subcontractors or vendors, and someone decides whether each one meets the requirement and when it lapses.

All three end in an ACORD form, but they test different things: copying the policy onto the right lines, reading a contract against the policy, and judging another agency's certificate with no policy in hand at all.

The contract check is where an account manager's hours go and where the agency's errors and omissions exposure sits. A plain reissue to a holder already on file is mostly produced by your agency management system, so a draft that matches it tells you little. A request with a subcontract attached forces a call on every line: is the holder an additional insured under this policy, is the waiver there, is the coverage primary, and may a certificate say so at all.

The form itself warns everyone about this. In its coverage section the ACORD 25 says that, notwithstanding any requirement of any contract, the insurance is subject to all the terms, exclusions and conditions of the policies. Its IMPORTANT box tells the holder that additional insured status depends on the policy itself, and that a statement on the certificate gives no rights in place of an endorsement. The contract check is the work of finding out whether that endorsement exists before anyone marks the box.

Your files also make the check fair to score. For each request you hold what came in, the policy forms, the certificate that went out and often the email telling the insured that something had to be endorsed first. That email matters most: a test that counts only issued certificates never sees the requests where the right answer was no.

Several states have written the industry's caution into law, and a draft has to know where those lines fall. What follows summarizes public pages and is not legal advice: your compliance contact and your counsel decide how each rule applies to your agency.

• Texas. The Texas Department of Insurance's certificate FAQ, last updated in October 2022, says a certificate may not refer to the insurance requirements of another contract, such as a construction or service contract; a job or contract number may appear only to identify the work. It also says a blanket additional insured endorsement does not let the certificate name the holder as an additional insured, though the certificate may state that the endorsement exists. Agents may not fill in questionnaires or affidavits about a contract's insurance requirements; they can send the policy language instead.
• New York. Insurance Law section 502 bars anyone, government bodies included, from requiring a liability certificate as a condition of a contract, work or payment unless it is the insurer's own form or a standard form the superintendent has approved, and from requiring wording the policy does not expressly contain. Minimum requirements may still appear in a competitive bid solicitation. The state's approved list now shows the ACORD 25 in its 2025/12 edition, approved on November 13, 2025, and does not list the 2016/03 edition.
• Georgia. The state insurance office lists among improper certificates a form that certifies coverage complies with the insured's contract with the holder, a summary of a policy provision that strays from its precise wording, and any ACORD or ISO edition other than the current approved ones. A policy provision may be named in the Description of Operations box by its exact title, form number and edition date, with a copy attached. The rules reach the people who request certificates, not only the agents who issue them.

Your reviewer, the account manager who knows certificates best, picks the set from requests your desk already answered, weighted toward the ones that took judgment:

• Contracts with an insurance exhibit. Subcontracts, vendor agreements from a hospital or school district, property management agreements, each with the certificate that answered it.
• A holder's own instructions. Some holders send a marked-up sample of what they want. One the National Park Service posts for a park puts its additional insured wording in the Description of Operations box and the park's name and address in the holder box.
• Asks a certificate can't carry. Northwestern University's published rules for certificates it receives ask for 30 days' prior written notice of cancellation or material change, and for the certificate to show that the policy covers liability assumed under the contract. Include requests like these, with what your team wrote back.
• Requests where the answer was no, or not yet: the ones that went to the carrier for an endorsement, or back to the insured with a question.
• State cases, if you write Texas, New York or Georgia risks, plus one lender asking for evidence of property, since the Texas certificate chapter doesn't apply to evidence a lender requires for a secured loan.
• Four or five routine reissues with no contract attached, as controls.

Lay the work out one contract requirement per row. For each, the draft states what the contract asks, what the policy provides with the page that shows it, and one of four answers: met and shown on the certificate; met, but provable only by sending the endorsement; not met without a policy change; or not something a certificate may say. Your reviewer marks each answer against what your account manager decided.

Two errors deserve a count of their own. A draft that calls a requirement met when the policy doesn't support it is the kind that turns into an errors and omissions claim, so it weighs more than a draft that flags too much. A draft that copies contract language into the Description of Operations box, where Texas and Georgia have said it doesn't belong, fails that row even when its coverage call was right.

Check the edition too: with the 2025/12 ACORD 25 on New York's list and the 2016/03 edition absent, each draft should name the edition it fills. Write the success criteria down before anything runs, for example: no requirement called met without a page behind it, every ask a certificate can't carry flagged with the reason, and nothing in the description the policy doesn't say.

Tracking is real work, and some agencies offer it to contractor clients. Florida shows why contractors care. Section 440.10 of its statutes makes a contractor that sublets work liable for workers' compensation for the subcontractor's employees unless the subcontractor secured it, and says a contractor shall require a subcontractor to provide evidence of that insurance; a subcontractor whose corporate officer has elected exemption provides a copy of the certificate of exemption. How that applies to a particular job is a question for the contractor's counsel.

It is still a weak first test for most agencies. The certificates come from other agencies about policies you have never seen, so a draft can compare a certificate only with a requirement, never with the coverage behind it. The answer key, which certificate was accepted and which subcontractor was told to fix one, usually lives with the insured, not in your agency system.

An agency that already runs a tracking service and kept its deficiency notices can make it the second job. Whichever job you test, the limits hold. Copies only, sent after an NDA is signed. Nothing logs in to your agency system, a carrier portal or an inbox. A licensed person decides what every certificate says and issues it.