ACORD 25 data extraction: fields, checks and automation

ACORD 25 data extraction means reading a certificate of liability insurance and turning it into structured data: who is insured, by which insurers, under which policies, for how much and until when. Teams that collect certificates from vendors, contractors, tenants or borrowers do it so they can check each certificate against the insurance requirements in their contracts, and chase the ones that fall short.

This guide walks through the form section by section, lists the fields worth extracting, covers the checks to run on every certificate, and explains how to automate the whole loop.

What is an ACORD 25 form?#

ACORD 25 is the standard Certificate of Liability Insurance published by ACORD (the Association for Cooperative Operations Research and Development), the nonprofit that maintains standard forms for the US insurance industry. An agent or broker issues it to show that a business holds liability coverage. The current edition is ACORD 25 (2025/12), which replaced the 2016/03 edition.

The person asking for the certificate is usually the one who carries the risk if the business isn't insured: a property manager leasing space, a general contractor hiring subcontractors, a lender financing a property, a franchisor, or an event venue. They are named on the form as the certificate holder. (The application forms an agent sends to an underwriter are different documents: see our guides to ACORD 125 and ACORD 126.)

How a certificate moves through COI tracking#

A certificate starts with a request and ends as a record in the system that tracks the vendor, tenant or loan. In between, someone has to read it, compare it with the contract and chase whatever is missing.

The sections of an ACORD 25, and what to extract#

The form's layout is standard, which makes it a good fit for automation, but the content varies a lot: different insurers per line, blank rows, typed or handwritten notes, and long descriptions of operations. Here is what each section holds and the fields worth capturing:

Limits by coverage line

The coverages grid carries most of the numbers, and each line has its own limits:

• Commercial general liability

  Each occurrence, damage to rented premises, medical expense, personal and advertising injury, general aggregate, products and completed operations aggregate, and whether the aggregate applies per policy, project or location.

• Automobile liability

  Combined single limit, or bodily injury per person and per accident plus property damage, and which autos are covered (any auto, owned, hired, non-owned).

• Umbrella or excess liability

  Each occurrence and aggregate, and whether it is occurrence or claims-made.

• Workers' compensation and employers' liability

  Statutory limits, plus employers' liability for each accident, disease per employee and disease policy limit, and whether any owner or officer is excluded.

• Other lines

  Professional liability, cyber, property or other lines the agent lists on the spare row.

The checks to run on every certificate#

Extracted data is only useful once it's compared with what the contract requires. These are the checks most COI tracking programs run, whether by hand or by software, and the fix when one fails:

• LimitsEach limit is at or above the contract minimum for that line. If not, ask for higher limits or an umbrella policy.
• DatesEvery required policy is in force for the full contract period. Diary the expiration date and request a renewal certificate before it lapses.
• Certificate holderYour legal entity name and address, exactly. If not, request a corrected certificate.
• Additional insuredADDL INSD is marked on the lines the contract requires, with an endorsement on file. If not, request the additional insured endorsement.
• Waiver of subrogationSUBR WVD is marked where the contract requires it. If not, request the waiver endorsement.
• InsurerEach insurer has an NAIC number and meets your minimum financial rating. If not, escalate to risk management.
• Named insuredMatches the vendor, tenant or borrower you contracted with. If not, confirm the legal entity: a parent or affiliate may not be covered.
• Description of operationsMentions the project, location or wording the contract requires. If not, request a corrected certificate.

Most failures are fixable with a corrected certificate or an endorsement from the agent, which is why the producer's contact details are worth extracting too: the follow-up email goes to them.

Why ACORD 25 extraction is harder than it looks#

The form is standard; the certificates aren't. These are the six things that break simple OCR and templates.

• Same form, different content

  The layout is standard, but insurers, rows and limits change from certificate to certificate, and blank rows are common.

• Scans and faxes

  Many certificates arrive as skewed scans or photos, where template-based OCR loses fields.

• Free text that matters

  The description of operations often holds the additional insured wording and endorsement numbers the check depends on.

• Several insurers per certificate

  Each policy row points to an insurer letter, so the extraction has to keep the links between rows and insurers intact.

• Endorsements and attachments

  Certificates often arrive with endorsement pages or ACORD 101 additional remarks, which need to be classified and read too.

• Volume and renewals

  Every vendor renews every year, so a program with a few thousand vendors sees thousands of certificates a year, with spikes at common renewal dates.

How to automate ACORD 25 extraction and COI checks#

Automation turns COI tracking from data entry into exception handling. The work splits into seven steps, most of which software can now do end to end.

1. Write your requirements down as rulesFor each contract type, list the required lines, minimum limits, additional insured and waiver requirements, and the certificate holder name.
2. Collect certificates in one placeRoute the COI inbox, vendor portal uploads and scans into one queue.
3. Classify the packetSeparate the ACORD 25 from endorsements, ACORD 101 remarks pages and other attachments.
4. Extract every fieldUse a model trained on ACORD forms that reads scans as well as native PDFs, and keeps each policy row linked to its insurer. Docsumo reads ACORD forms with 99% field-level accuracy.
5. Run the checksCompare the extracted values with the rules for that vendor's contract and flag every failure with the field and the rule it broke.
6. Send only exceptions to a personA reviewer sees the failing certificates, with each flagged field linked to its spot on the page, and requests the fix from the agent.
7. Push the data where it's usedSend the results to your vendor management, property management or loan servicing system through an API or webhook, and track expiration dates there.

Teams already do this at scale. Vertikal RMS uses Docsumo to verify certificates of insurance through ACORD capture, and Arbor reached 99% accuracy on insurance compliance documents while saving more than 3,000 hours a month.

• 99%99%accuracy on insurance compliance documents at Arbor
• 3,000+3,000+hours a month saved at Arbor
• 95%+95%+of documents processed straight through, without manual review

Best practices for managing extracted COI data#

• Keep the source. Store each certificate with the data extracted from it, so an auditor can see where every value came from.
• Track expirations, not just receipt. The day a policy expires is the day a vendor stops being compliant. Request renewals 30 days ahead.
• Store endorsements with the certificate. Additional insured and waiver status depend on them.
• Protect the data. Certificates carry policy numbers and business details. Use a vendor with SOC 2 Type 2 coverage and role-based access.
• Measure exceptions. Track the share of certificates that pass on first submission, by vendor and by agent, to see where requirements aren't clear.

The bottom line#

An ACORD 25 is a one-page summary of a business's liability coverage, and its value comes from checking it against what your contract requires. Extract every field, keep the links between policies and insurers, run the same checks on every certificate, and let people handle only the ones that fail.

Book a demo with a few of your own certificates, or start a free trial.

Frequently asked questions#