The three categories
| Category | Examples | Built for | Typical commitment |
|---|---|---|---|
| Enterprise vendor-compliance platforms | myCOI, TrustLayer, Jones, Evident, Certificial | Large GCs, national REITs, risk departments with a compliance owner | Annual contract, quote-based pricing, implementation period |
| SMB COI tools | CertShield and a small number of others | 20–2,000 unit property managers, 10–100 sub GCs | Monthly, self-serve, live in a day |
| Spreadsheet + shared drive | Excel, Google Sheets | Under ~25 vendors with one requirement tier | Free, and costs you a recurring hour a week |
Most buying mistakes are category mistakes rather than product mistakes. A 300-unit property manager who buys an enterprise platform ends up paying for a compliance workflow designed for a risk department they do not have. A 40-vendor GC who stays on a spreadsheet ends up with an audit trail that is a folder of PDFs.
The eight questions
1. What does the AI actually read?
"AI-powered" covers everything from optical character recognition on a template to a vision model reading a phone photo of a certificate. Ask what happens with a scanned fax, a rotated page, a non-ACORD carrier letter, and a certificate with four endorsement pages attached. The endorsement pages are the real test — plenty of tools read page one and stop.
2. Are endorsements verified, or just the checkbox?
The ADDL INSD checkbox on an ACORD 25 is a claim typed by an agency, not proof. A tool that marks a vendor compliant because the box is ticked has automated the exact mistake you bought it to prevent. Ask specifically whether it flags a claimed additional insured with no endorsement attached.
3. Who chases the renewal — and in what language?
Chasing is the operational cost of COI tracking; everything else is a one-time setup. Ask whether reminders go to the producer or only to the vendor, whether the sequence escalates, and whether it can send in Spanish. A large share of US trade vendors read Spanish first, and an unread reminder is not a reminder.
4. Is there human review before a verdict is published?
Any vendor claiming perfect automated accuracy is overselling. The useful question is what happens on the uncertain document: does it silently guess, or does it route to a person? Ask for the confidence threshold and what sits below it.
5. How deep is the audit trail?
When a claim arrives, the question is what you required, what you checked, and when you knew. You want an append-only record of every document version, every verdict, every chase message and every human decision — exportable, not just visible on a screen.
6. How long is setup, honestly?
Ask for the actual median time from signature to a first compliance snapshot, and what they need from you to get there. Enterprise platforms often measure implementation in weeks because they are configuring a compliance program, not just importing a vendor list.
7. What are the contract terms?
Annual commitment or monthly? Does the price step when you cross a vendor count mid-term? Can you export everything on the way out, and in what format? The export question is the one that reveals how confident a vendor is in their retention.
8. What do they refuse to claim?
This is the most informative question on the list. Ask whether they can catch a mid-term policy cancellation. The honest answer is no — carriers do not broadcast cancellations to certificate holders, and current ACORD wording only defers to the policy provisions. Any vendor who says yes without qualification is telling you how they will handle every other edge case too.
Where each category is genuinely the right answer
- Enterprise platform: you have a dedicated risk or compliance owner, hundreds to thousands of vendors, owner or lender reporting obligations, and procurement requires a master services agreement.
- SMB tool: you are the person who does COI tracking on top of another job, you have twenty-five to a few hundred vendors, and a week of implementation is not something you can absorb.
- Spreadsheet: under about twenty-five vendors, one requirement tier, one maintainer, and a weekly calendar block you actually keep.
Comparing specific tools?
See the side-by-side comparisonsA note on review sites
G2, Capterra and similar directories are useful for signal on support quality and onboarding pain, and close to useless on accuracy — nobody measures their own tool's extraction accuracy before writing a review. Read them for the operational complaints and ignore the star ratings on the technical claims.