By Patrick Turcotte, COO, Docutrax. Last reviewed: 21 October 2026.
Vendor compliance and contractor compliance are the same function applied to two different populations: confirming that contractually required insurance is in place, correct, and current. Your procurement system sorts third parties by label. Your insurance requirements should follow the exposure each relationship creates, which cuts across those labels in both directions.
Four things do turn on the label, and all four are places where the label causes a mistake. There is an ISO endorsement written for vendors that grants a service vendor nothing. Most state anti-indemnity statutes reach construction contracts only, and a maintenance agreement may be one. Contractors carry licensing and bonding obligations that vendors do not. And the two populations run on different cycles and gates, which changes how you operate the program even where the coverage requirements match.
One note on terms before anything else. "Vendor compliance" also describes retail chargeback programs and cybersecurity third-party risk, and "contractor compliance" also describes federal affirmative action obligations under the OFCCP and CMMC obligations on defense work. If that is what you came for, this is the wrong page.
What the labels mean
The distinction is commercial and organizations draw it differently. In most programs a vendor supplies goods or a recurring service under a master agreement or purchase order: janitorial, landscaping, pest control, IT, uniform supply, waste hauling. A contractor performs defined scope work on your property or project under a contract with a start and an end, usually with its own subcontractors below it: the roofer, the mechanical trade, the general contractor running a capital project.
One statutory difference sits on the contractor side. Contractors carry licensing and bonding obligations that suppliers and most service vendors do not. California requires a $25,000 contractor's bond for an active license, an amount that took effect on 1 January 2023 under Senate Bill 607. That is a licensing matter, and it belongs on a contractor's compliance record as its own line item with its own expiry date.
Keep one more question out of this. Whether a worker is an employee or an independent contractor is a tax and employment matter, decided by the IRS on common law control principles, and it has nothing to do with what insurance you require from a company you have engaged.
Sources: CSLB bond requirements
Five questions that set your requirements
Ask these about the relationship. The answers cut across both labels and they do almost all the work.
Do their people come onto your property? If yes, you need workers compensation and employers liability, and you need to think about the action-over exposure sitting behind your indemnity clause. True of the janitorial vendor and the roofer alike.
Does what they do leave something behind that can fail later? Installed work, applied products, repairs and supplied goods create a completed-operations tail. Consulting hours and a security guard's shift do not. The tail decides whether you need completed operations status and long retention, and the label tells you nothing about it.
Do they drive on your behalf, or onto your site? Business auto, including hired and non-owned exposure where the third party owns no vehicles.
Do they take custody of your property, your money, or your keys? General liability Exclusion j.(4) bars property damage to personal property in the care, custody or control of the insured, and a crime policy written for the third party's own losses does not reach theft from you. Close that with the right line before a loss finds it.
Do they hold your data or connect to your systems? Cyber and technology errors and omissions, with the data types and the level of system access named. General liability was never written for this.
Answer those for a landscaping vendor and a facade contractor and the requirement sets come out different, but not along the line your procurement system draws.
The vendors endorsement trap
Ask a janitorial company's broker for the vendors endorsement and you will get the CG 20 15, titled Additional Insured, Vendors. File it and your records show additional insured status, on a form whose name matches what you asked for.
The CG 20 15 is a products form. It grants status for liability arising out of the named insured's products shown in the Schedule, "which are distributed or sold in the regular course of the vendor's business," and it excludes several categories of the vendor's own conduct. It was written for a distribution chain: a manufacturer adds the retailer selling its product so that an injured buyer can reach the manufacturer's coverage. The connection the form requires is to the named insured's product. Craig Stanovich's IRMI commentary makes the point with an example in which the injury came from a competitor's product, so "the necessary connection has not been established" and the grant does not respond.
A janitorial company, a landscaping crew or a security firm is a vendor in the procurement sense and has no product that you distribute or sell. For those relationships the grant has nothing to attach to. What you want is a scheduled or automatic additional insured form written around operations, which sits in a different part of the ISO series.
What to send the broker, for a service vendor: "Please issue additional insured status by endorsement, and send the endorsement itself rather than a certificate reference. We are looking for an operations-based form such as CG 20 26 or the automatic CG 20 43. The CG 20 15 vendors endorsement does not fit this relationship. Please confirm the form number and edition date."
Thirty seconds of writing, and it is the difference between a file that looks compliant and one that responds.
Sources: Craig Stanovich, Additional Insured Endorsements, A Potential Minefield, Part 1, IRMI
Where the label does matter
Four places, and it is worth holding them as a set, because everywhere else the label is noise.
The vendors endorsement. Covered above. The one ISO form with "vendors" in its title is a products form, and asking for it by that name on a service contract produces a document that cannot respond.
Anti-indemnity statutes. Most reach construction contracts only, which means a clause your state would void in a subcontract may be enforceable in a service agreement, and a maintenance agreement nobody calls construction may sit inside the statute anyway. Covered below.
Licensing and bonding. A contractor's licence and bond are compliance items with their own expiry dates and no certificate to show them. A vendor usually has neither.
The operating model. Cycles, gates, turnover, tiering and retention clocks all differ between the two populations, which changes how you run the program even where the coverage requirements are identical. Covered near the end.
Everything in between, the coverage lines and the endorsement mechanics, works the same way for both.
Requirement sets by exposure category
The practical answer to "how many requirement sets do I need" is usually five or six, grouped by exposure. Something like this. Your contracts govern, so treat the table as a starting point.
Category | Typical third parties | Lines to require | Additional insured form | Completed-operations tail |
|---|---|---|---|---|
Supply only | Materials, components, consumables, equipment delivered | General liability including products-completed operations; business auto if they deliver; workers compensation and employers liability where their people enter your property | CG 20 15 fits here, and only here | Yes, through the product |
On-site service, nothing left behind | Janitorial, security, landscaping, pest control, window cleaning | General liability; workers compensation and employers liability; business auto; crime or care, custody and control where they hold keys or handle funds | CG 20 26, or the automatic CG 20 43 | Generally no |
On-site service that installs, applies or repairs | Flooring treatment, mechanical and HVAC repair, elevator service, roofing repair, painting | General liability including products-completed operations; workers compensation and employers liability; business auto | CG 20 10 plus CG 20 37, or the automatic equivalents | Yes |
Professional and advisory | Design, engineering, energy audits, environmental consulting | Professional liability; general liability; workers compensation and employers liability where they come on site | On the general liability policy only. Professional liability insurers typically decline additional insured requests, because they underwrite the named insured's own professional risk | Exposure outlives the engagement, but professional liability is usually claims-made, so ask about the retroactive date and the extended reporting period instead of a completed-operations tail |
Data and system access | IT, SaaS, payroll, managed services, anything touching your systems | Cyber and technology errors and omissions, with the data types and access level named; general liability; crime where they touch funds | Ask whether the carrier will endorse it, because this varies. Ask the harder question too: does the policy respond to your losses, or only to the vendor's own | Exposure outlives the contract, and these policies are usually claims-made too, so ask how long coverage has to stay in force after the engagement ends |
Construction and capital work | General contractors and their trades | General liability including products-completed operations; workers compensation and employers liability; business auto; umbrella or excess; builders risk where applicable | CG 20 10 plus CG 20 37, or the automatic CG 20 33 and CG 20 38, with CG 20 39 and CG 20 40 for completed operations on a blanket program | Yes, and long |
Two things that table does that a label-based set cannot. It puts the CG 20 15 where it belongs, which is in exactly one row. And it keeps the same mechanical contractor in two rows when it does routine service at eleven properties and capital work at four, which is what actually happens.
If you are wondering what to change in the procurement system: add an exposure category attribute and hold it separately from the vendor type field. The vendor type drives purchasing. The exposure category drives insurance. Conflating them is how a facilities maintenance agreement ends up on the janitorial requirement set.
Sources: Professional liability and additional insured status, Big I Virtual University · Navigating cyber insurance for vendor agreements, Amwins
Choosing the additional insured form
Different forms do different jobs, several editions of each are in circulation at once, and a broker sending whichever one is on file is a common reason a compliant-looking file does not respond at tender.
Form | What it grants | Where it fits |
|---|---|---|
CG 20 10 04 13 and later | Scheduled status for ongoing operations performed for the additional insured at the scheduled location | Contractors, and any vendor performing operations at a site |
CG 20 37 04 13 and later | Scheduled status within the products-completed operations hazard | Completed operations. A separate form from the CG 20 10, and where the tail exists you need both |
CG 20 26 04 13 and later | Scheduled status for ongoing operations, or in connection with premises owned by or rented to the named insured | Often the fitting scheduled form for a non-construction service vendor. Current multistate edition is 12 19 |
CG 20 33 04 13 and later | Automatic status for the party the third party agreed in writing to add | Construction relationships where only the contracting party needs status |
CG 20 38 04 13 and later | Automatic status for other parties the third party must add under that same written agreement | Construction relationships where an upstream owner, developer or lender also needs status |
CG 20 43 12 19 | Automatic status for any party the third party agreed in writing to add | The non-construction automatic form. Excludes the products-completed operations hazard and carries a broad professional services exclusion |
CG 20 15 04 13 and later | Products-based status for a vendor distributing or selling the named insured's scheduled products | Supply chains only. Current multistate edition is 12 19 |
Two things decide most vendor-side outcomes.
The first is that the CG 20 10's grant stops when the work does. Section B cuts off coverage once all work on the project at that location, other than service, maintenance or repairs, is complete, or once that portion of the work has been put to its intended use by someone other than another contractor on the same project. That is why completed operations needs the CG 20 37 alongside it, and why "additional insured including completed operations" on a certificate tells you nothing about whether both forms were issued.
The second is about blanket wording, and it is where you should expect pushback. The ISO automatic forms carry construction in their titles and not in their grants: the CG 20 33 and CG 20 38 both key off what the named insured "agreed in writing in a contract or agreement," with no construction limitation in the operative text. When ISO retitled the CG 20 33 in December 2019 it inserted the words "A Written," so the title now reads "Automatic Status When Required In A Written Construction Agreement With You." That reinforces that the agreement must be written. It does not narrow the grant to construction.
None of which means those are the right forms for a service contract. Carrier manuscript blanket wording frequently does limit itself to construction, and manuscript wording is what you will usually be looking at. So when a broker tells you it is all included under their blanket endorsement, they may be right and they may be reading a form that excludes the relationship in front of you. Ask for the endorsement and read it. A program that accepts a certificate tick as evidence of blanket status is assuming a trigger nobody has checked.
One more thing about limits, because it surprises people. Under the 04 13 and later editions, where additional insured coverage is required by contract, the insurer pays the amount required by the contract or the amount available under the policy limits, whichever is less. Your requirement is a ceiling on recovery and not just a screening threshold. The same forms apply "only to the extent permitted by law" and state that the coverage "will not be broader than that which you are required by the contract or agreement to provide."
Sources: ISO CGL multistate forms list, FCS · ISO new and revised multistate optional general liability endorsements effective 12/1/19, FCS
Waiver of subrogation and primary and noncontributory
Same mechanisms for both populations. Require them by exposure. Two traps catch people.
The first is that there are two waivers, on two policies. On the general liability side the ISO CG 24 04 waives the insurer's rights, not the insured's own right to sue you directly, and under the current 12 19 edition it responds only to the extent the insured waived its own right of recovery before the loss. On the workers compensation side the NCCI WC 00 03 13, or its state equivalent, is a separate endorsement on a separate policy. Requiring "waiver of subrogation" without saying which is how a program ends up holding one of the two.
The second is that primary and noncontributory treatment does not follow from additional insured status, and it does not follow from a contract clause either. The CG 20 01 requires both conditions: the additional insured has to be a named insured under the other insurance, and the third party has to have agreed in writing that its insurance would be primary and would not seek contribution. The 04 13 edition is withdrawn outside the US Virgin Islands in favour of a 12 19 edition, so establish which one is attached.
More on both mechanisms in Waiver of Subrogation: What It Does and What It Does Not.
Workers compensation: where the vendor population gets caught
The coverage you require is the same for both populations. One trap catches vendor programs more often, because vendors are more often multi-state and get reviewed at speed across a long list.
Four states run monopolistic funds: Ohio, North Dakota, Washington and Wyoming. Washington puts it plainly, that it "does not allow private workers' compensation coverage" and you "must purchase your coverage from L&I or be a certified self-insured employer." In none of the four does the state fund provide employers liability, so employers liability comes from a stop gap endorsement. Where the employer also operates in non-monopolistic states that endorsement usually attaches to the workers compensation policy; where it operates only in the monopolistic state it attaches to the general liability policy.
Either way it is an endorsement, and neither location is where a reviewer looks by habit. A reviewer scanning the certificate's employers liability boxes on a Washington vendor finds them empty and either raises a deficiency that is not real or accepts a submission carrying no employers liability at all. Both happen, and the second one is the expensive one.
Wyoming is a partial case. Its mandate covers extrahazardous industries and those employers must use the state fund. Everyone else may use the state fund, use a private carrier, or carry nothing. Find out which a Wyoming third party has, because a private policy carries employers liability in Part Two and a state fund filing does not.
One related point worth knowing, because it is the gap that matters most and no certificate shows it. Part Two of the workers compensation policy excludes liability assumed under a contract, so when you enforce an indemnity clause after an injury to the third party's own employee, the claim lands on their general liability policy instead. The standard general liability form accommodates that: its employer's liability exclusion carries an exception for "liability assumed by the insured under an 'insured contract'." What defeats you is a broadened action-over or employee injury endorsement that strips the exception out. That is an endorsement-level check.
Sources: Washington L&I insurance requirements · North Dakota employer guide to workers compensation · Ohio Rev. Code § 4123.35 · Workers compensation rules of monopolistic state funds, FCS · Wyoming workers compensation, ALFA International
Vendors who never come on site
Three exposures that a premises-focused requirement set tends to miss. All three are common on the vendor side and rare on the contractor side.
Supplied goods still create a completed-operations tail. The products-completed operations hazard covers bodily injury and property damage occurring away from premises the named insured owns or rents, arising out of "your product" or "your work," and it carries its own aggregate limit separate from the general aggregate. A supply-only vendor that never sets foot on your property can generate a claim years later. Treating completed operations as a construction concern is how that gets missed.
Advice and drawings do not belong to general liability. Design, engineering, energy audits, environmental consulting and any vendor whose deliverable is a judgment need professional liability, because general liability policies routinely exclude professional services by endorsement. If your requirement set lists general liability limits and stops, you have not addressed what that vendor can do to you.
Data and system access. Cyber and technology errors and omissions, with the data types and the level of system access named. "Cyber liability" as a bare requirement can be satisfied by a policy that excludes the exact data the vendor holds, and by one written to keep the vendor's doors open rather than to cover your losses. Ask which.
Indemnity: where the label is legally real
Most anti-indemnity statutes apply exclusively to construction contracts, and that single fact cuts two ways.
It means an indemnity provision a state would void in a subcontract may be enforceable in a service or supply agreement in the same state, because the statute does not reach it. And it means a vendor doing maintenance or repair work may sit inside the statute even though nobody in your organization calls that work construction. In the 50-state survey published by Matthiesen, Wickert & Lehrer, S.C., "construction contract" covers "construction, alteration, repair, maintenance, moving, demolition or excavation or other development or improvement to land." A facilities maintenance agreement is not obviously a construction contract to a procurement team. It may well be one to the statute.
Enforceability varies past that threshold. Three shapes show up. Broad form has the third party indemnify you regardless of fault, including your own sole negligence. Intermediate form covers the third party's sole or partial fault and absorbs your share of a jointly caused loss. Limited form answers only for the third party's own fault. California voids broad form in construction contracts and voids indemnity for your active negligence in several settings, with each provision turning on the contract date. Montana and Oklahoma allow only indemnity proportionate to the third party's own fault. Georgia voids sole-negligence indemnity only, so a shared-fault clause survives there.
Two mechanical points underneath all of that. Indemnity and additional insured status are separate risk transfer mechanisms that interact: an indemnity clause obligates the third party to answer for liability, and it does not obligate anyone to add you to a policy. And an assumed indemnity obligation is insurable only through the insured contract exception to the general liability contractual liability exclusion, which is the same provision manuscript endorsements narrow or delete. The clause and the coverage behind it have to be checked together, because either one alone is decoration.
None of this is legal advice and application turns on the contract, the facts and the jurisdiction. It is a reason to have the indemnity language in each agreement type reviewed against the states you operate in, instead of inheriting a template written for the other population.
Sources: Anti-indemnity statutes in all 50 states, Matthiesen, Wickert & Lehrer · Construction anti-indemnity chart, Gordon Rees Scully Mansukhani · Cal. Civ. Code § 2782 · The survey's definition is a composite of how these statutes tend to read rather than any single state's enacted text; the operative language is always the individual statute.
How the two populations differ in practice
The coverage requirements track exposure. The operating model tracks the label, and here the differences are worth designing around.
Vendor population | Contractor population | |
|---|---|---|
Relationship shape | Recurring, open-ended, renewed | Defined scope with a start and an end, then closeout |
Volume and turnover | Large population, stable membership, changes slowly | Smaller at any moment, changes constantly as projects mobilize and finish |
Natural gate | Payment, system access, or site badge | Mobilization and work start, then progress payment |
Requirement stability | One set can serve a whole category for years | Varies by trade, scope, contract value, and jurisdiction |
Tiering below them | Usually none, or a single layer | Multiple tiers of subcontractors, each with its own gaps |
Entity exposure | The contracting entity plus the manager or operator | The owner, the developer, the lender, the general contractor, often a ground lessor |
Completed-operations tail | Present for some categories, absent for others | Present for most trades, and long |
Record retention driver | The renewal cycle | The statute of repose and the length of the tail |
Typical review depth | Certificate review across most of the population, deeper where the exposure warrants it | Endorsement-level review as the working default, full policy review where scope, jurisdiction or potential liability justifies it |
Read it as tendencies. A single sourcing vendor supplying a critical component can carry more exposure than a small painting subcontractor, and if your program cannot see that, it is running on labels.
Running one program across both
Run one program, with requirement sets built around exposure categories, and let the operating model differ where the populations differ. Two separate programs duplicate the review work and lose the third parties who appear in both. One universal requirement set over-specifies for a supplier and under-specifies for a facade contractor.
Gate where you have leverage. Contractors gate at mobilization and work start, because once the crew is on site the leverage is gone. Vendors gate at payment, system access or badge issuance, because there is no single moment of arrival to hold. Decide your escalation rules before you need them.
Treat renewal as the main event on the vendor side. A contractor's compliance record gets built once and maintained through a project. A vendor's is re-established every year, across a population large enough that renewal is where the program either holds or quietly erodes.
Let the tail drive retention. Completed operations claims arrive after the contractor has gone and after the vendor agreement has been replaced. Your compliance file has to outlive both.
Handle shared third parties once. The same mechanical contractor doing capital work at four properties and routine service at eleven is one company in two exposure categories. Fifteen unconnected reviews is waste. One review that ignores which entities need to appear in which endorsement schedules is worse.
What this costs in-house is worth being honest about. Five or six requirement sets means someone owns the form numbers and the editions and keeps them current as ISO revises. Gating at payment means accounts payable has to hold a cheque on a compliance status, which is a process argument before it is an insurance one. And if you run a small, uniform vendor population where certificates are the right depth, most of this apparatus is overkill and a spreadsheet with a diary date will serve you.
Where Docutrax fits
Docutrax runs this as a managed operation across both populations. Licensed property and casualty insurance professionals read the certificates, endorsements and policies, with CRIS-certified Account Managers on construction risk work, and the team gets involved with the third party and their brokers and agents to resolve what falls short. More than 2,000,000 certificates, endorsements and policies have been through that review since 2012.
You set the requirements and the escalation rules, and you make the compliance decisions. Docutrax surfaces what the documents establish and what they do not.
Where certificate review stops answering these questions
Certificate review is the right depth across a large share of most vendor populations, and doing it properly is real work: coverage lines, limits as reported, policy dates, named insured, carrier rating, expiration tracking. The question is never whether certificates matter. It is whether the depth of review matches what your contracts require and what the relationship exposes you to.
But look back at what this page has raised. Which additional insured form was issued and what its trigger is. Whether the completed operations form is there alongside the ongoing operations form. Whether the action-over exception survives on the policy. Whether employers liability exists behind a monopolistic state filing. None of those is established by the ACORD 25, which states on its face that it "IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER." The form has no field for an endorsement form number. Its employers liability boxes are a producer's entry. There is no field at all for a stop gap endorsement sitting on a general liability policy.
A certificate that reads "Blanket AI per form on file" has told you that a form exists somewhere. Where scope, jurisdiction, completed-operations exposure or potential liability warrants it, the endorsement pages and then the policy are the proportionate next step. Make that judgment at the category level, so you decide it once.
FAQs
Quick answers
Is there a legal difference between a vendor and a contractor?
Not for insurance purposes. The distinction is commercial and each organization draws it slightly differently. Two legal regimes do attach to contractors specifically: state licensing and bonding, and most state anti-indemnity statutes, which reach construction contracts only. Neither determines what coverage lines or endorsements you should require.
Should vendors be additional insureds, or is that only for contractors?
It follows the exposure. Any third party whose acts or omissions could produce a claim against you is a candidate. What differs is which form fits, and for a non-construction service vendor that is usually the CG 20 26 or the automatic CG 20 43.
Can I use the ISO vendors endorsement for my service vendors?
No. The CG 20 15 is a products form, and a janitorial or landscaping company has no product you distribute or sell, so the grant has nothing to attach to. Use an operations-based form instead.
Our broker says it is all included under their blanket endorsement. Is that enough?
Not on its own. The ISO automatic forms trigger on a written contract or agreement regardless of what their titles say, but carrier manuscript blanket wording often does limit itself to construction, and manuscript wording is what you will usually be looking at. Ask for the endorsement, not a certificate reference, and read what it actually grants.
Do vendors need completed operations additional insured status?
Some do. The test is whether their work or product leaves something behind that can fail later. Flooring treatment, mechanical repair, roofing, elevator service and supplied components all create a tail; consulting hours, staffing and security shifts generally do not. Where the tail exists, the CG 20 37 is a separate form from the CG 20 10 and you need both.
Where do tenants fit?
Neither category, which is why a vendor-versus-contractor binary fails a real estate portfolio. A tenant's requirements come from the lease, and the usual set is general liability with the landlord and manager as additional insureds, property coverage on their own contents and improvements, and a waiver of subrogation. Give tenants their own exposure category.
Can one requirement set cover both vendors and contractors?
Only if the population shares an exposure profile, which across a full third-party population it almost never does. Five or six category-level sets, each naming the endorsement forms it requires, governs better than one universal set or a bespoke set per third party.
Does contractor compliance mean the same thing on federal work?
No. There, "contractor compliance" usually means affirmative action obligations administered by the OFCCP, or cybersecurity obligations under CMMC and NIST 800-171. Separate programs, separate rules. Insurance compliance on federal work still turns on the contract's insurance requirements and the same endorsement mechanics described here.
Get in touch with Docutrax
Related Articles
COI Tracking Software: A Buyer's Guide to 11 Providers
Every product in this category collects certificates. What separates them is how far into the documents the review goes, and who does the work when one comes back short.
Hidden Compliance Gaps: What Your Certificate Isn't Telling You
A certificate can be entirely accurate and still leave the questions that decide a claim unanswered. Here are seven of them, and the document that answers each.
Excess Liability Insurance: What Owners Need to Know
Excess liability adds limits, not scope. Whether the layer sitting above a contractor's CGL actually reaches you is decided by documents the certificate never shows.
