Subcontractor Insurance Requirements: A Practical Checklist for Small Businesses

Begin with the exposure, not a generic COI requirement

A graphic designer working remotely creates a different loss profile from a handyman working inside occupied homes. Requiring the same insurance package from every subcontractor can create unnecessary friction while still missing the coverage that matters.

Map the subcontractor’s operations: injury to third parties, damage to customer property, professional advice, driving, tools, cyber access, and whether anyone else works under the subcontractor. Then write the insurance requirement around those exposures.

Worker classification is a separate legal question

An insurance clause does not determine whether a worker is legally an independent contractor. The IRS says classification depends on facts and circumstances, including behavioral control, financial control, and the type of relationship. State workers’ compensation systems can use their own definitions and exemptions.

That means a business should not rely on a 1099, a subcontract agreement, or a COI as proof that a worker is outside workers’ compensation rules. For private employers, the Department of Labor directs businesses to the relevant state workers’ compensation authority.

What a basic evidence package can include

The appropriate evidence depends on the contract and work, but a review often starts with current certificates and then moves to endorsements when the contract asks for additional-insured, waiver, or priority-of-coverage wording.

• Legal entity name and current policy dates
• General-liability limits appropriate to the project
• Commercial auto or hired/non-owned auto when the work creates vehicle exposure
• Workers’ compensation evidence when required
• Professional liability for advice or service-error exposure
• Cyber coverage when the subcontractor handles sensitive data or credentials
• Actual endorsements for risk-transfer terms that a certificate alone cannot create

Review the certificate for consistency, not just presence

A certificate can be current and still fail the contract. Check the subcontractor name, insurer, policy dates, limits, and coverage lines. If the contract requires additional-insured status, confirm that the policy or endorsement provides it rather than assuming a certificate checkbox is enough.

Texas and New York regulator guidance both emphasize that certificate information cannot expand the underlying policy. Use the COI as a starting document, not the entire risk-transfer file.

Build a renewal and expiration process

Subcontractor evidence has a shelf life. If work continues past a policy expiration date, an old certificate no longer demonstrates current insurance. Track expirations and request updated evidence before the renewal date rather than after a client audit.

For frequent vendors, record recurring requirements once and review them at renewal. For one-time vendors, retain evidence for the project period and any contractually required completed-operations period.

Avoid turning insurance into false confidence

Insurance is one part of vendor risk management. It does not replace scope-of-work controls, training, licensing checks, safety practices, data-security rules, or contract language. Nor does a high limit guarantee that every loss created by a subcontractor is covered.

The useful outcome is a documented decision: what risk was identified, what evidence was requested, what gaps remain, and whether the business accepted those gaps.

Frequently asked questions