An insurance clause requires one party to carry specified coverage so that when something goes wrong, there is a solvent third party (the insurer) standing behind the indemnity. It is the difference between an indemnity that is collectible and one that is just a promise from a company that may not have the money. The clause works through three levers: the coverage types and limits required, additional-insured status that lets you claim directly on the other side's policy, and a waiver of subrogation that stops the insurer from turning around and suing you.
TL;DR
- An insurance clause makes the indemnity real by putting a solvent insurer behind it. Without it, an indemnity is only as good as the indemnitor's bank account.
- Require the right coverage types for the risk: commercial general liability, professional liability (errors and omissions), cyber, workers' compensation, and auto where relevant. Set per-occurrence and aggregate limits that match the deal's exposure.
- Additional insured status lets you claim directly on the other party's policy. Waiver of subrogation stops their insurer from suing you to recover what it paid. Get both in writing.
- A certificate of insurance is evidence, not coverage. Require an additional-insured endorsement and the right to see the policy, because the certificate alone does not confer rights.
- The most common review miss is requiring claims-made coverage (like cyber and E&O) with no tail, so coverage disappears the day the policy lapses, even for incidents that happened while it was active.
What an insurance clause actually does
An insurance clause converts a counterparty's promise into a funded one. Three mechanics do the work.
1. It mandates coverage. The clause lists the policies the other party must carry, the minimum limits, and how long the coverage must stay in force. This ensures that if the indemnity is triggered, there is money behind it.
2. It gives you rights on their policy. Additional-insured status makes you an insured under the other party's liability policy for claims arising from their work, so you can tender a claim straight to their insurer. A waiver of subrogation stops that insurer, after it pays, from suing you to get the money back.
3. It proves and maintains the coverage. The clause requires certificates of insurance, additional-insured endorsements, advance notice of cancellation, and often the right to review the actual policy. These are how you verify the coverage exists and stays in place over the life of the deal.
Why it matters: the dollars at stake
Consider a company that hires a vendor for IT work. The vendor's engineer causes a data incident that costs the company $1.5M in response and third-party claims.
This is an illustrative example. The recovery depends on the insurance terms.
- With a cyber policy at $2M, the company named as additional insured, and a waiver of subrogation, the company tenders the claim to the vendor's insurer and recovers the loss, even if the vendor itself is thinly capitalized.
- With no insurance requirement, the company relies on the vendor's indemnity, and if the vendor has $200,000 in assets and no relevant policy, the indemnity is worth $200,000.
Same incident, same vendor. The insurance clause is what makes a $1.5M loss recoverable instead of a paper claim against an insolvent counterparty. That is why sophisticated buyers treat the insurance schedule as seriously as the indemnity.
Who wants what
| Party requiring insurance (buyer) | Party carrying insurance (vendor) | |
|---|---|---|
| Limits | High per-occurrence and aggregate | Lower, matched to its existing policies |
| Coverage types | CGL, E&O, cyber, workers' comp, auto | Only what the work genuinely requires |
| Additional insured | Named on CGL (and ideally cyber) | Resist, or limit to ongoing operations |
| Waiver of subrogation | Required across policies | Limited to specific coverages |
| Certificate vs endorsement | Endorsement plus right to see the policy | Certificate of insurance only |
| Notice of cancellation | 30 days' advance written notice | "Endeavor to" notify, no firm duty |
The pattern: the buyer wants high limits, additional-insured status, a subrogation waiver, and real proof; the vendor wants to provide only the coverage its work needs and to limit how far the buyer can reach into its policies.
Market-standard language
A typical insurance clause in a services or vendor agreement reads close to this:
INSURANCE.
During the Term and for [two] years thereafter, Vendor will maintain,
at its own expense, the following coverage with insurers rated A- or
better by A.M. Best:
(a) Commercial General Liability of not less than $1,000,000 per
occurrence and $2,000,000 in the aggregate;
(b) Professional Liability (Errors and Omissions) and Cyber Liability
of not less than $2,000,000 per claim and in the aggregate;
(c) Workers' Compensation at statutory limits and Employer's Liability
of not less than $1,000,000; and
(d) Commercial Automobile Liability of not less than $1,000,000 where
Vendor uses vehicles in performing the Services.
Vendor will name Customer as an additional insured on the policies in
(a) and (d), and all policies will include a waiver of subrogation in
Customer's favor. Vendor will provide certificates of insurance and
additional-insured endorsements on request and will give Customer at
least 30 days' prior written notice of cancellation or material change.
Two details carry the value. The "and for [two] years thereafter" keeps claims-made coverage (E&O, cyber) alive for incidents discovered after the work ends, and the additional-insured endorsement requirement (not just a certificate) is what actually gives the customer rights on the vendor's policy.
The negotiation: standard, fallback, walk-away
Negotiate limits, the coverage list, and the rights separately.
| Issue | Opening position (buyer) | Fallback both sides accept | Walk-away (vendor) |
|---|---|---|---|
| Limits | High, scaled to deal exposure | Limits matched to realistic worst case | Limits below the deal's plausible loss |
| Cyber / E&O | Required, with tail coverage | Required, claims-made plus survival period | No cyber coverage at all |
| Additional insured | On CGL and cyber | On CGL (and auto), not professional lines | Refuses additional-insured status |
| Waiver of subrogation | Across all policies | On CGL and property, where customary | No waiver |
| Proof | Endorsement plus policy review right | Certificate plus additional-insured endorsement | Certificate of insurance only |
| Notice of cancellation | 30 days, firm obligation | 30 days where the policy allows | "Endeavor to" notify |
Most deals land on CGL, E&O, and cyber at limits sized to the exposure, additional-insured status on the general-liability and auto policies, a subrogation waiver, and endorsements plus certificates as proof. Professional-liability lines are usually claims-made, so the survival tail is the point to fight for.
Common carve-outs / variations
Insurance terms vary by the work and the risk:
- Occurrence vs claims-made. CGL is usually occurrence-based (covers incidents that happened during the policy period whenever the claim is made). E&O and cyber are usually claims-made (cover only claims made while the policy is active), so they need a survival period or tail.
- Additional insured, ongoing vs completed operations. An additional-insured endorsement can cover only ongoing operations or also completed operations. For work with a long tail of risk, the buyer wants both.
- Primary and non-contributory. Buyers often require the vendor's policy to respond first ("primary") and not seek contribution from the buyer's own insurance ("non-contributory"). This stops the vendor's insurer from sharing the loss with yours.
- Self-insured retentions and deductibles. A high self-insured retention can mean the vendor pays the first large slice itself, which matters if the vendor is thinly capitalized.
- Coverage maintained after termination. For claims-made lines, require the coverage (or a tail) for a set number of years after the deal ends, since incidents surface late.
A buyer-protective fallback often reads:
The coverage required above will be primary and non-contributory to any
insurance maintained by Customer. For any claims-made policy, Vendor
will maintain the coverage, or purchase an extended reporting period
(tail), for not less than two years after termination of this Agreement.
Jurisdiction and enforceability notes
Insurance clauses are generally enforceable, but several practical and legal points shape them:
- A certificate is not a policy. Courts in most states treat a certificate of insurance as evidence only, not as conferring coverage or additional-insured rights. The rights come from the policy and the endorsement, so require the endorsement.
- Additional-insured scope is read from the endorsement. The breadth of additional-insured coverage (ongoing vs completed operations, the type of claims covered) is set by the endorsement language, not the contract's request. A clause asking for "additional insured" can be satisfied by a narrow endorsement.
- Anti-indemnity statutes can limit additional-insured coverage. Some states, especially in construction, restrict how far one party can be insured for its own negligence, which can void or limit additional-insured endorsements. These vary by state and industry.
- Insurance does not replace the indemnity. The two work together. Insurance funds the indemnity, but coverage gaps, exclusions, and limits mean the indemnity still matters where the policy does not respond.
This is general information, not legal advice for a specific deal. Enforceability and the reach of additional-insured coverage turn on the governing law, the policy, and the facts, so confirm against the controlling law and the actual endorsement before relying on the coverage.
Review checklist: red flags to catch
- The clause requires claims-made coverage (cyber, E&O) with no tail or survival period.
- It accepts a certificate of insurance as the only proof, with no additional-insured endorsement.
- Limits are far below the deal's plausible worst-case loss.
- No additional-insured status, so you cannot claim directly on the vendor's policy.
- No waiver of subrogation, leaving the vendor's insurer free to sue you after it pays.
- The coverage is not primary and non-contributory, so the vendor's insurer shares the loss with yours.
- Notice of cancellation is "endeavor to" notify, an unenforceable best-efforts promise.
How it interacts with other clauses
Insurance is the funding mechanism for several risk clauses; read it with:
- Indemnification: insurance is what makes the indemnity collectible.
- Limitation of liability: coverage can sit above the cap for the carved-out risks (data, IP).
- Data protection: cyber coverage backs the data-breach exposure the buyer most fears.
- Survival: the obligation to keep claims-made coverage must survive termination.
- Termination: require the tail coverage to run for years after the deal ends.
For the broader workflow, see the in-house contract review playbook.
FAQ
What is an insurance clause in a contract? It is a provision requiring one party to carry specified coverage, with minimum limits, for the life of the deal. Its purpose is to put a solvent insurer behind the other party's indemnity, so a covered loss is recoverable even if that party itself cannot pay.
What does "additional insured" mean? Being named additional insured makes you an insured under the other party's liability policy for claims arising from their work. It lets you tender a claim directly to their insurer instead of suing the party and hoping it pays. The rights come from an additional-insured endorsement, not from the certificate alone.
What is a waiver of subrogation? It is the insurer's agreement not to step into its insured's shoes and sue you to recover what it paid out. Without it, after the vendor's insurer covers a loss, it could turn around and sue your company for causing it. The waiver shuts that down.
Is a certificate of insurance enough? No. A certificate is evidence that coverage exists at a point in time, but most courts hold it does not confer coverage or additional-insured rights. You need the actual additional-insured endorsement, and ideally the right to review the policy, to have enforceable rights.
What is the difference between occurrence and claims-made coverage? Occurrence coverage responds to incidents that happened during the policy period, whenever the claim is later made. Claims-made coverage responds only to claims first made while the policy is active. Cyber and professional liability are usually claims-made, so they need a tail or survival period to cover late-surfacing claims.
What coverage limits should I require? Size the limits to the deal's plausible worst-case loss, not a generic number. A small services engagement may need $1M to $2M in general and professional liability; a deal handling sensitive data warrants higher cyber limits. Match the limit to the exposure rather than copying a template.
Why does insurance matter if there is already an indemnity? Because an indemnity is only a promise to pay, and a thinly capitalized counterparty may not be able to honor it. Insurance puts a solvent insurer behind the promise. The two work together: the indemnity allocates the risk, and the insurance funds it.
Related clauses
Clauses that get negotiated alongside this one.
