Building a COI Tracker with AI: What It Takes, and What It Misses

Yes, you can build a certificate of insurance (COI) tracker with AI. What it can't do on its own is run the program: reviewing every document the same way, following up with partners until gaps close, tracking every interaction, and staying accurate as everything around it changes.

Key takeaways

• AI makes the app easy to build. The rules it runs on are the hard part, and they have to come from someone who knows what your contracts require.
• A COI tracker answers "do we have a current certificate?" Insurance compliance verification answers "does this coverage meet the contract?"
• Most gaps live outside the certificate, in endorsements like the CG 20 10 and CG 20 37, waivers of subrogation, and primary and non-contributory wording.
• A spreadsheet can work for a short list of partners. Multiply partners by policies to see when it stops working.
• Whatever you use, you need an audit trail that proves what you knew and decided on a past date.
• Asking for endorsements adds documents, it doesn't remove work. The real cost is running compliance: scale, consistency, partner outreach, resolving gaps, logging every interaction and keeping the AI accurate.
• Approving an exception, like a lower limit or a missing endorsement, is a business decision about how much risk you keep. AI can inform it. Your people should make it.

We hear the same thing from more and more ownership teams and general contractors. "We can probably track this ourselves." Sometimes that means a spreadsheet with calendar reminders, or a custom field in QuickBooks, Sage or Procore. Now it often means an AI tool built over a weekend.

We understand the appeal. And we've seen what these systems miss. Before illumend, the technology we built at myCOI reviewed more than 45 million documents, managed more than 1.2 million agreements, cleared more than 750,000 third-party partners and flagged more than 2 million coverage gaps before they became claims. That's where this guide comes from.

Why is building a COI system the hard part, not the easy part?

AI has made writing the code easy. But an AI-built tracker only knows what you tell it, and without a compliance process in place today, you're automating a best guess. The system won't fail loudly. It will mark partners compliant and miss the gap no one knew to ask about.

What's the difference between COI tracking and insurance compliance verification?

COI tracking confirms a certificate is on file and current. Insurance compliance verification confirms the coverage behind it meets what your contract requires.

Collecting certificates and pulling policy numbers, limits, carriers and dates off them keeps getting easier. None of that tells you whether the coverage transfers the risk your contract was written to transfer. The certificate is evidence. Compliance is the decision you make after checking that evidence against the contract, the endorsements and the project's requirements. Our guide to what a certificate must include covers the certificate side.

What does a homegrown COI tracker miss?

It misses what the certificate doesn't show. Here's the example we see most often.

A subcontractor sends a current certificate. The general liability limits are right and the additional insured box is checked. A basic tracker marks the trade partner complete.

But the contract requires additional insured status for completed operations. The endorsement behind the certificate is a CG 20 10, which covers ongoing operations only. Completed operations needs a CG 20 37 or an equivalent endorsement, and it isn't there. Construction defect claims often come from completed operations, sometimes years after the work is done.

The tracker didn't misread anything. It never had the contract requirement, the endorsement language, or the connection between the two. The same gap shows up in other forms:

• The certificate names a sister LLC instead of the entity on the contract.
• The waiver of subrogation box is checked, but there's no endorsement behind it.
• The contract requires primary and non-contributory coverage, and the policy doesn't say so.
• The umbrella meets the dollar amount but doesn't follow form over the required underlying coverage.
• The policy was cancelled mid-term after the certificate was filed.

For what to require in the first place, see our subcontractor insurance requirements guide.

Isn't it enough to ask for the endorsement too?

It's a fair point, and plenty of teams do. But asking for the endorsement doesn't solve the problem, it adds to it. Now there are more documents per partner, per policy, per renewal, and every one has to be read against the contract the same way, every time.

That's the real issue. Building a tracker is a project. Running compliance is an operation, and it never stops.

What does it take to run COI compliance day to day?

Six jobs, every day, for every partner:

• Scale. 350 trade partners with three or four policies each, such as general liability, auto, umbrella and workers' comp, is more than 1,000 renewals a year. That's about four every working day, before new partners, new projects or mid-term cancellations.
• Consistency. The same requirement has to be applied the same way across every partner, project and reviewer. A rule that's checked on Monday and missed on Friday isn't a rule.
• Outreach. Someone has to request what's missing from partners and their brokers, and follow up until it arrives. That's rarely one email.
• Resolving non-compliance. A gap needs a clear deficiency notice, a corrected document, a second review, and a decision when it isn't fixed: hold payment, hold site access, or approve an exception.
• Tracking every interaction. Who was asked for what, when, what came back, and who approved it. That record is what protects you in a claim or an audit.
• Keeping the AI accurate. Models change, contracts change and policy forms change. Someone has to test the system against real documents, retest after every change, and own the result when it's wrong.

None of that is the app. All of it is the job, and it's the part illumend was built to take off your team's plate.

Can ChatGPT check whether a COI meets contract requirements?

It can read the certificate. Whether it can make the right compliance call depends on what it's grounded in, and a general-purpose model starts with none of your contracts or endorsements.

This isn't an argument against AI. It's an argument for the right AI on the right job. Before you trust any AI with compliance, ours included, look for four things:

1. It checks against what your actual contract requires, not a generic checklist.
2. It reads the endorsements behind the certificate, not just the boxes on it.
3. It shows its work: which requirement it checked, what evidence it found, and why it decided what it did.
4. It knows when it isn't sure, and it says so.

And ask who's accountable when it's wrong. We wrote about that in who bears the risk when AI COI compliance software gets it wrong.

How does Lumie make the compliance call?

Lumie, illumend's AI expert for insurance compliance, was built around those four things. Lumie reads the certificate and the endorsements, checks them against the requirements set for that partner relationship, shows the evidence behind every decision, follows up with partners and their brokers until gaps close, and logs every interaction along the way, including whether each email was sent, opened and replied to. When endorsement wording is unclear, Lumie raises its hand.

People stay involved where judgment matters most. That's when a decision could affect a claim, or when someone has to decide whether a known gap is acceptable on a live project. Lumie makes the call. Your team has the final say.

Who should decide whether to approve an insurance exception?

Your team should, every time. Exceptions are where compliance stops being a document question and becomes a business decision.

Not every exception means the same thing. A few you'll see often:

• A lower limit. A partner carries $1 million where the contract asks for $2 million. Approving it means your business carries the difference.
• A missing endorsement, promised later. The broker says it's coming. Approving it for 30 days is very different from approving it for the life of the project.
• Alternative coverage. An umbrella makes up a shortfall, or a sole proprietor is exempt from workers' comp under state rules. It may be fine, but only if it responds the way the contract intended.
• A low-risk scope. A one-day delivery may not need the same requirements as the subcontractor framing the building.

Each one shifts risk back onto you. Before anyone approves one, they need to know what kind of exception it is, who has the authority to approve it, whether it's limited to one project or one date, and what it would mean if a claim came in tomorrow.

Lumie helps with all of that. It flags the gap, shows the evidence, explains what's missing in coverage terms, and records every exception: who approved it, why, and until when. But deciding how much risk your business is willing to keep isn't a decision AI should make for you. That one belongs to your people.

When is a spreadsheet no longer enough to track COIs?

Multiply your partners by the number of policies each one carries. If that's more renewals than one person can review, chase and resolve every week, you've outgrown the spreadsheet.

If you work with a handful of partners and only need the certificate itself, a well-kept spreadsheet may be all you need. Our COI best practices will help you run it well.

How do you prove coverage for a claim or a workers' comp audit?

You need a record of what you knew at the time: the evidence you had, the requirements that applied, and the decision you made. A spreadsheet that only shows today's certificate can't prove what was in force on a past date.

Workers' comp audits make this concrete. If a subcontractor can't show proof of coverage for the period they worked, the auditor can charge their payroll to your policy. Keeping the certificate, the endorsement and the review date on file is what keeps that from landing on you. More on that in our guide to subcontractors that don't have insurance.

You can also verify a COI is valid before it ever goes on file.

10 questions to answer before you build an AI COI compliance system

If you can answer all ten with a name and a process, you're ready to build. If you can't, those gaps are what your system will automate.

1. Who will read each contract and turn its insurance clause into rules?
2. Will the system review endorsements, or only the certificate?
3. How will it handle blanket additional insured endorsements that never name you directly?
4. Who updates the rules when contracts or policy forms change?
5. How will you test the AI's accuracy, and who retests it when the model changes?
6. Who reviews the calls the system isn't sure about, and who has the authority to approve an exception?
7. Who follows up with trade partners and their brokers, and how many times?
8. Does a failed review hold up payment or site access, or does it just send another reminder?
9. Is every request, reply and approval logged, so you can produce a full audit trail for a claim or a workers' comp audit?
10. When the system marks a partner compliant and a claim proves otherwise, who owns that?

Frequently asked questions

Can I build my own COI tracking system with AI?

Yes. AI can build an app that collects certificates, extracts dates and limits, and sends renewal reminders. The hard part is the rules. Someone has to turn each contract's insurance requirements into checks the system can run, including endorsements the certificate doesn't show.

Should we build or buy COI tracking software?

Build if you already run a compliance process and have people to maintain the rules, chase partners, resolve gaps and retest the AI as things change. Buy if you need that work done consistently at scale. If you only track a handful of certificates, a spreadsheet may be enough.

Isn't asking for the endorsement enough?

It helps, but it adds work rather than removing it. Every endorsement still has to be read against the contract, the same way, for every partner and every renewal. Gaps then need outreach, follow-up, a second review and a logged decision.

Can ChatGPT check if a certificate of insurance meets contract requirements?

It can read a certificate and pull out its details. It can't make a reliable compliance call unless it has your contract requirements and the endorsements behind the certificate, and it should show the evidence for every decision and flag the ones it isn't sure about.

What does a homegrown COI tracker miss compared to insurance compliance software?

Most homegrown trackers check the certificate only. They miss gaps in the endorsements, such as a CG 20 10 where the contract needs completed operations coverage (CG 20 37), waivers of subrogation with no endorsement, missing primary and non-contributory wording, the wrong named entity, and mid-term cancellations.

Is a spreadsheet enough to track certificates of insurance?

It can be for a short list of partners. Multiply your partners by the policies each carries. If that's more renewals than one person can check against contracts each week, a spreadsheet will start missing things. For example, 350 partners with three or four policies each is more than 1,000 renewals a year.

How accurate is AI for COI review?

Reading accuracy and compliance accuracy are different. Most AI tools extract certificate data well. Compliance accuracy depends on whether the AI checks against your contract requirements and endorsements, shows its evidence, and escalates unclear wording to a person.

Should AI approve insurance exceptions?

No. AI can flag the gap, explain what's missing and show how similar exceptions were handled. Whether to accept a lower limit, a late endorsement or alternative coverage is a decision about how much risk your business keeps. A person with the authority to approve it should make that call, and the approval, reason and expiry date should be on record.

How do I prove what coverage a partner had on a past date?

Keep a dated record of the certificate, the endorsements, the requirements that applied and the decision made at review. A system that overwrites old certificates with new ones can't prove coverage for a past claim or a workers' comp audit.

The bottom line

AI has made software easier to build, and it's put real capability within reach of teams that could never have built it before. That's a good thing.

But AI has democratized the ability to build software. It hasn't democratized the expertise, or the hours, it takes to run a compliance program every day. Understand the whole job first, and you'll know whether to build, buy, or keep the spreadsheet.

Want to see how Lumie checks coverage against your contracts? Schedule a demo.