What is a business insurance policy? How to read one

A business insurance policy is a contract between a company and an insurer. The company pays a premium, and in return the insurer agrees to pay defined categories of loss, up to stated limits, for events inside a stated policy period, subject to the exclusions and conditions written into the document. The National Association of Insurance Commissioners (NAIC), the US standard-setting organization governed by the chief insurance regulators of the 50 states, the District of Columbia, and five territories, defines a policy as a written contract ratifying the legality of an insurance agreement, and a policy period as the time during which coverage is in effect [1].

The contract framing is the useful part. The dates bind you, the conditions impose obligations on you, and the exclusions and endorsements decide what the coverage is actually worth. Most people handed a business policy are never shown how the document is assembled, so they file the summary page and discover the rest during a claim.

This guide is for the person who already holds the policy and needs to know what to extract, what to put in a calendar, and what to check before it renews. It covers commercial lines only, is not a buying guide, and does not cover personal auto, home, life, or health cover.

What a business policy is called

Business insurance policy, commercial insurance policy, business insurance contract, and policy wording are four names for one instrument: the written contract between an insurer and an insured business. Nothing turns on which name your broker uses.

What does matter is that the instrument is rarely a single file. It is an assembled set, and one published policy text spells the assembly out. The federal flood insurance General Property Form, printed in full in the Code of Federal Regulations and covering non-residential buildings and their contents among other property, defines the policy as "the entire written contract between you and us": the printed form, the application and declarations page, any endorsements issued, and any renewal certificate [6]. That form governs flood cover, not your commercial policy, but it shows the shape. If you hold only the page your broker emailed you, you hold a fraction of the contract.

The business lines below (general liability, professional indemnity, cyber, buildings, motor fleet) are subtypes, not different instruments. Each has the same anatomy.

Why a certificate is not the policy

A certificate of insurance (COI) is a one-page document, issued by a broker or agent, that reports the existence of insurance to a third party [2]. ACORD, the insurance industry's standards development organization and the publisher of the certificate forms used across the US market, states the distinction plainly: a certificate is not an insurance policy and "does not serve to provide, endorse, amend, extend, or alter in any way the terms of an insurance policy." Only an endorsement, rider, or amendment can change coverage [2].

ACORD also notes that the third parties who receive certificates are known as certificate requestors or holders, and that the majority are issued at policy renewal [2]. That leaves you two jobs: tracking your own policies, and tracking the certificates you collect from vendors, subcontractors, and tenants as proof they carry the cover your contracts require. The two records expire on their own schedules. Contracko ships a certificate of insurance reminder tool for the second job.

What each side commits to

Both sides take on obligations, and only one set shows up on a renewal invoice.

The insurer commits to pay covered loss, up to the limits shown in the policy, for events inside the policy period that are not excluded. Liability policies also allocate the cost of defending claims, and whether those defense costs eat into the limit or sit outside it is a policy term rather than a default. Federal financial responsibility rules for underground storage tanks, for example, require an insurer's certificate to state the each-occurrence and annual aggregate limits "exclusive of legal defense costs, which are subject to a separate limit under the policy" [6].

The insured commits to more than paying the premium, which the NAIC defines as the money charged for the coverage, reflecting expectation of loss [1]. The rest of your side is written into the conditions, and the flood General Property Form shows what that looks like on a real form: give prompt written notice, separate damaged from undamaged property, prepare an inventory, and send a signed and sworn proof of loss within 60 days of the loss [6]. Your own policy sets its own duties and deadlines. Find those before you need them.

The parties involved

The insurer carries the risk. It writes the wording, sets the limits, and pays claims.

The insured is the party covered by the policy [1], and the entity written into the declarations is the named insured [1]. Get this wrong and the wrong company is covered. If your group has restructured, added a subsidiary, or changed its registered name since the policy was issued, check this first.

The broker or agent sits between you and the insurer. The NAIC distinguishes the two: an agent sells, services, or negotiates policies on behalf of a company or independently, while a broker works on behalf of the customer and is not restricted to one company's policies, though the commission is still paid by the insurer [1]. Both are licensed intermediaries, and neither is a party to the contract, but both hold the paperwork, so treat them as the source you chase, not the record you rely on.

Additional insureds are parties added to your policy by endorsement, so that your cover responds for them too. Landlords, main contractors, and large customers often require the status in their contracts, and it is created by the endorsement, not by writing a name on a certificate [2]. That has a practical edge: ACORD notes that a typical liability policy obliges the insurer to notify only the first named insured of cancellation, unless the policy is endorsed to notify another party [2]. If your company is an additional insured on a supplier's policy, you will not automatically hear when it is cancelled.

The structure of a policy

Commercial policies are assembled from the same building blocks, in roughly this order. Where a policy is built on a standard industry form, two carriers' versions can share pages of identical language, and the differences that matter then sit in the endorsements rather than the form.

Declarations

The declarations page, often just called the dec page, is the summary sheet. The NAIC describes declarations as the policy statements about the applicant and the property covered [1], and the flood form quoted above adds the crucial detail: it summarizes the information supplied in the application, describes the term, limits, premium and deductible, and is itself part of the policy [6]. On a commercial policy it also carries the schedule of forms and endorsements attached.

Treat it as an index, not a summary. If you extract one page into your contract records, extract this one, then use its schedule of forms to check you hold every attached document.

Insuring agreement

The insuring agreement is the promise. It states what the insurer will pay for, and under what trigger.

Liability policies use one of two triggers, and the difference is one of the most consequential distinctions in the document. An occurrence policy responds to an accident that results in bodily injury or property damage during the policy period [1]. A claims-made policy pays only if both the triggering event and the claim itself are reported to the insurer during the policy term [1]. On a claims-made policy the practical anchors are the retroactive date, which sets how far back a triggering event may have occurred, and the extended reporting period, which allows claims to be reported for a window after the policy ends [6]. Letting a claims-made policy lapse without arranging an extended reporting period can strand years of past work with no cover.

Exclusions

Exclusions are where coverage is actually decided. An exclusion is any condition or expense the policy specifically does not cover.

Read them as a block, and read them after the insuring agreement, because they cut it back. They are also where the gaps between policies live. The Washington State Office of the Insurance Commissioner points out that commercial and business insurance typically does not cover flood damage, which is why flood cover is bought separately through the National Flood Insurance Program [7], and the NAIC makes the same point about digital risk: most commercial property and general liability policies do not cover cyber risks [1]. Neither gap is visible from the declarations page.

Do not assume the section headed "exclusions" is the whole story either. The same flood form splits property insured, property not insured, and exclusions across three sections [6], and a definition or an endorsement can narrow cover just as effectively. Capture the exclusions that bear on how your business operates, not all of them.

Conditions

Conditions are the rules of engagement: what you must do to keep the coverage, what you must do after a loss, what happens when other insurance applies, and how the policy can be cancelled or not renewed [6]. This is the part that generates diary entries. Notice deadlines, proof-of-loss windows, and reporting duties all live here, and none of them appear on the declarations page.

Endorsements

An endorsement is an amendment or rider to a policy that adjusts the coverages and takes precedence over the general contract [1]. That last clause is the point: where an endorsement conflicts with the printed form, the endorsement wins.

Endorsements are how a standard form becomes your policy. They add additional insureds, waive subrogation, extend cover to a new location, raise or drop a sublimit, or carve out an activity. They are also easy to lose between the broker's email and the shared drive, and easy to drop at renewal without anyone noticing. If a contract requires you to name a customer as an additional insured, the evidence you have done so is an endorsement, not a certificate [2].

Limits and deductibles

Limits and deductibles interact, and the order they apply in changes what an insurer actually pays. A limit is the maximum value to be derived from a policy [1], and a commercial liability policy can carry several at once. A per-occurrence limit caps what the insurer pays for a single event; an aggregate limit caps the total payable for one or more losses during the policy period, or on a single project [1]. Federal regulation reflects both, requiring certificates to state each-occurrence and annual aggregate limits [6].

A deductible is the portion of the insured loss, in dollars, paid by the policyholder [1]. Where both apply, they work in a set order: the deductible comes off first, and the limit caps what is left. The flood policy states that sequence exactly, paying "only that part of the loss that exceeds your deductible amount, subject to the limit of liability that applies", and then names two of its own coverages the deductible does not touch at all [6]. Check which of your coverages the deductible actually reaches.

Three details are worth checking on your own form.

How often the deductible bites. Check whether yours applies per claim, per occurrence, or per policy year, and whether one loss can attract more than one. The flood form applies separate deductibles to the building and the personal property under the same policy [6], so a single event there costs two.

The aggregate is a shrinking pool. Every paid claim reduces what is left for the rest of the period, so a policy that looked adequate in month one can be materially thinner in month ten, and nothing on your dec page updates to tell you.

Defense costs may or may not erode the limit. Inside the limit, a heavily defended claim consumes cover before a penny reaches the claimant. Subject to a separate limit, as the underground storage tank rules contemplate, the position is different [6].

The mechanic, with illustrative figures only, runs like this. Take a hypothetical liability policy at 1 million dollars each occurrence and 2 million dollars annual aggregate, with a 25,000 dollar deductible, and assume the aggregate is eroded only by what the insurer pays. A claim settling at 400,000 dollars breaks down as 25,000 from the insured and 375,000 from the insurer. After five such claims the insurer has paid 1,875,000, leaving 125,000 of the aggregate. On the sixth identical claim the insurer pays only that remaining 125,000, and the insured absorbs its 25,000 deductible plus the 250,000 the aggregate can no longer reach. The pool ran dry even though no single claim came near the 1 million per-occurrence cap. Whether the deductible itself erodes the aggregate depends on the wording, and if it does the pool empties sooner, which is why the answer has to come from your policy.

The main business lines

A company can easily hold several policies, from more than one insurer, on more than one renewal date. These are the lines this guide covers.

General liability. Cover that protects the business if someone gets hurt or property damage occurs at your place of business [7], sold outside the US as public liability insurance.

Commercial property and buildings. Cover against loss or damage to real or personal property from perils including fire, lightning, business interruption, loss of rents, windstorm, hail, water damage, and explosion [1], with the flood gap noted above [7]. See buildings insurance for how buildings cover splits from contents cover, which matters when a lease assigns each to a different party.

Professional indemnity. Cover for liability arising out of professional or business related duties, tailored to the specific profession, and listed in the NAIC's glossary under the US label professional liability [1]. See professional indemnity insurance. This is the line where the claims-made trigger, the retroactive date, and the extended reporting period matter most [1][6].

Cyber. Bought precisely because a gap exists elsewhere. The NAIC states that cyber policies are highly customized for clients [1], so you cannot assume anything from another company's policy, and the conditions, such as incident notification deadlines and required security controls, need reading. See cyber insurance.

Motor fleet. Commercial auto cover for the vehicles a business operates, and where a fleet is regulated the floor is set by law: federal rules set a minimum level of financial responsibility of 750,000 dollars for for-hire interstate or foreign carriage of non-hazardous property in vehicles rated at 10,001 pounds or more, and 5 million dollars for certain bulk hazardous materials [5]. That is a floor on financial responsibility, not an instruction to buy a policy, because a carrier can meet it with an insurance endorsement, a surety bond, or written authorization to self-insure [5]. See motor vehicle insurance.

Workers' compensation. Requirements are set state by state and some states administer the cover themselves. In Washington it is bought from the state Department of Labor and Industries and is usually mandatory [7]. Confirm your obligation with the relevant state authority; the compliance detail beyond that is out of scope here.

Dates and obligations to track

Four clocks run around a business insurance policy, and only one of them is the renewal date.

The policy period. Start and end dates sit on the declarations page [6]. Do not assume a twelve-month term; read the dates.

Cancellation and non-renewal notice. Insurance in the US is regulated by the states, coordinated through the NAIC [1], so there is no single national notice rule, and the rules that exist carry conditions worth reading before you rely on them. In Washington, where a policy is cancellable at the insurer's option, the insurer must generally mail the named insured written notice at least 60 days ahead, 90 days for medical malpractice, and at least 10 days for non-payment, but that section does not apply at all to cover placed in the surplus lines market under chapter 48.15 RCW [3]; non-renewal of a policy subject to the same section takes at least 60 days' notice, or 90 for medical malpractice [3]. California's commercial rules run off a statutory definition that expressly excludes workers' compensation, surplus lines, fidelity and surety, and auto covered by section 660 [4]. For a policy inside that definition, once it has been in force more than 60 days, or immediately if it is a renewal, the insurer may cancel only on enumerated grounds such as non-payment, fraud, or a materially increased risk [4], and must give at least 30 days' notice, or 10 for non-payment or fraud [4]. Check the rule for the state of issue and for your line, then record the resulting deadline against the policy.

Claims reporting. The prompt-notice duty and any proof-of-loss deadline sit in the conditions, in the shape shown earlier [6]. On a claims-made policy the reporting window is the coverage trigger itself [1], so a late notice is not an administrative slip.

Certificate expiry. Every COI you have collected carries its own expiry, and most are reissued at the vendor's renewal [2]. That is a separate diary.

For the workflow of running these clocks, see the companion guide on how to track insurance policy renewals. The insurance policy expiration calculator works a deadline out from a policy's dates, and the insurance policy expiration reminder pulls expirations and obligations out of the document.

Where policies go wrong

The failures are consistent, and they are contract operations problems rather than underwriting problems.

The filed record is a fraction of the contract. The consequence lands at claim time, when the endorsement schedule references documents nobody kept, and the certificate filed as proof of additional insured status is not the endorsement that created it [2][6].

Cancellation notice reaches one inbox. Because a typical liability policy notifies only the first named insured [2], whoever has to find replacement cover can learn of it late, and an additional insured on someone else's policy may not learn at all.

Renewal is worked as administration rather than a decision. The consequence is silent narrowing: limits, exclusions, and endorsements can move while the renewal date is met, and nobody compares the new schedule against last year's.

The requirement and the policy live in different systems. The clause setting a minimum limit sits in a customer contract, the policy satisfying it sits with the broker, and the spreadsheet in between holds a renewal date but not the notice window or the retroactive date. Reconciliation then happens when a customer asks for evidence, the worst possible moment to start.

Related documents

A policy rarely stands alone, and some of its obligations are written into your other contracts. These are the documents to link to it in your records.

• Certificates of insurance, both the ones you issue to customers and the ones you collect from suppliers [2].
• Endorsements, riders, renewal certificates, and renewal packets, which amend the policy or form part of the contract for the new term [1][6]. File them with the policy, not separately.
• Insurance clauses in commercial contracts. Leases, master services agreements, supplier terms, and construction contracts can all specify minimum limits, required endorsements, and evidence obligations. See the insurance obligation clause entry for what those clauses ask for, and the guide to master service agreements for where they sit in a contract stack.
• The obligations register. Insurance requirements recur, so they belong wherever you track the rest. See the guide to building a contract obligations tracker.

Insurance policy management checklist

Work through this against a real policy, not from memory.

1. Collect the whole contract. Printed form, declarations page, every endorsement on the schedule, current renewal certificate. Chase the broker for anything listed but missing [6].
2. Confirm the named insured is the entity that needs cover today, including any subsidiary added or renamed since issue [1].
3. Record the policy period as two dates, effective and expiry, from the declarations page rather than a broker email [6].
4. Record the limits and deductible. Per-occurrence, aggregate, any sublimits, whether defense costs sit inside or outside the limit, and whether the deductible can bite more than once per loss [1][6].
5. Identify the trigger. Mark the policy occurrence or claims-made, and for claims-made record the retroactive date and the extended reporting period [1][6].
6. Extract the exclusions touching your operations, checking flood and cyber specifically [1][7].
7. Calendar the notice deadline, not just the renewal date. Look up the cancellation and non-renewal rules for the state of issue and work back from expiry [3][4].
8. Calendar the claims-reporting duties from the conditions, before you need them [6].
9. Name an owner per policy, with reminders routed to them, not a shared inbox.
10. Reconcile against your contracts. List every contract specifying insurance limits or additional insured status, then confirm an endorsement exists for each [2].
11. Track collected certificates separately, recording each vendor COI's expiry, limits, and required endorsements, with a reminder to chase the renewal before the current one lapses [2].
12. Review before renewal, not after. Compare the new endorsement schedule and exclusions against last year's before accepting terms.

Every item there is a document, a date, an obligation, or an owner, which is why it holds together better in a contract system than a spreadsheet. Contracko is AI contract management software: upload a policy and its endorsements, and AI analysis surfaces the dates, terms, and obligations, while reminders repeat on renewal and point at the policy's owner. Batch extraction exports the result as CSV, Excel, or JSON.

Start with your largest limits, anything a customer contract depends on, and anything written on a claims-made basis. Start a free trial with those, and add the rest once the record is trustworthy.

Sources

[1] National Association of Insurance Commissioners, Consumer Glossary, About the NAIC, and Cybersecurity (policy terminology, state-based regulation, and the cyber coverage gap). content.naic.org, content.naic.org, and content.naic.org

[2] ACORD, Certificates of Insurance FAQ (a certificate is not a policy and cannot alter coverage). acord.org

[3] Revised Code of Washington 48.18.290 and 48.18.2901 (cancellation and non-renewal notice, and the surplus lines exclusion). app.leg.wa.gov and app.leg.wa.gov

[4] California Insurance Code 675.5, 676.2, and 677.2 (scope of the commercial cancellation rules, the grounds, and the notice owed). leginfo.legislature.ca.gov, leginfo.legislature.ca.gov, and leginfo.legislature.ca.gov

[5] 49 CFR 387.9 and 387.7 (fleet minimum financial responsibility, and how it may be met). ecfr.gov and ecfr.gov

[6] 44 CFR part 61, appendix A(2), General Property Form, and 40 CFR 280.97 (policy structure, deductible and proof-of-loss terms, and defense costs outside the limit). ecfr.gov and ecfr.gov

[7] Washington State Office of the Insurance Commissioner, Learn how business insurance works (common coverages, the flood gap, and workers' compensation). insurance.wa.gov

Images in this article were generated with the assistance of AI.