Nunery advocates for AI systems that evaluate Certificates of Insurance against an organization's specific requirements, reason across connected documents, produce traceable decisions, and preserve human oversight

Key Takeaways

- Grounding AI in an organization's specific insurance requirements is essential, but it is only part of what reliable certificate of insurance compliance requires.

- AI systems must reason across contracts, certificates of insurance, endorsements, schedules, amendments, and exceptions to evaluate the complete body of evidence.

- Accurate document extraction does not guarantee an accurate compliance decision because compliance depends on the relationships among requirements and supporting documents.

- Every AI-supported compliance determination should be traceable, explainable, and subject to human approval so it can withstand an audit, dispute, or claim.

- Organizations evaluating grounded AI compliance platforms should measure both false passes that leave risk uncovered and false failures that create unnecessary work.

INDIANAPOLIS, Sept. 16, 2026 /PRNewswire/ -- Kristen Nunery, CEO of illumend and founder of myCOI, is calling on business leaders to demand more from grounded artificial intelligence (AI) in Certificate of Insurance (COI) compliance. Nunery details her point of view in a new article titled "Grounding Is Half the Answer in COI Compliance." The issue affects organizations that rely on vendors, contractors, tenants, franchisees, and other third parties to maintain contractually required insurance coverage, including businesses in construction, commercial real estate, retail and franchising, and government.

Grounded AI is an approach that bases its outputs on defined, authoritative information rather than relying solely on the general knowledge acquired during model training. In COI compliance, that information includes an organization's contracts, leases, insurance requirements, vendor classifications, required endorsements and approved exceptions.

Nunery's position is that grounding AI in an organization's insurance requirements provides a standard for evaluating compliance, but it does not provide sufficient evidence to make a reliable decision. AI systems must also connect information across contracts, certificates, endorsements, schedules, and amendments—and explain how that evidence supports each determination.

Modern AI can accurately extract policy numbers, coverage limits, carriers, and expiration dates from certificates. The distinction, Nunery argues, is that document extraction determines what an insurance document says, while compliance analysis determines whether the full body of evidence satisfies the requirements for a specific vendor, contract, project, or business relationship.

"COI compliance is a document-relationship problem before it is a document-reading problem," Nunery said. "An AI system can read every individual document correctly and still reach the wrong conclusion if it cannot understand how the agreement, certificate, policy, endorsement, and schedule relate to one another."

What Grounded AI Means for COI Compliance

Grounded AI is anchored to a defined source of truth rather than relying on general information absorbed during model training. In COI compliance, the relevant source of truth includes an organization's contracts, leases, insurance requirements, vendor classifications, project standards, required endorsements, and approved exceptions.

Grounding changes the question the system answers. An ungrounded system may assess whether a vendor appears adequately insured, even though "adequately insured" has no universal definition. A grounded system evaluates whether submitted evidence satisfies the requirements governing that specific third-party relationship.

The key difference is that grounded AI evaluates insurance evidence against requirements established by the organization rather than relying on a generalized model-generated standard of adequate coverage.

"Grounding gives the AI the standard instead of asking it to invent one," Nunery said. "A system that cannot tell you where its definition of compliant came from does not really have one."

Why Is Grounded AI Only Half the Answer?

Even a system perfectly grounded in an organization's requirements can reach the wrong decision if it fails to connect all relevant evidence.

For example, a certificate may indicate that additional insured coverage is present while an attached endorsement covers only ongoing operations. If the governing agreement also requires completed operations coverage, approving the vendor based solely on the certificate could leave the organization exposed if a claim arises after the work has ended.

Every document in that example could be read accurately. The incorrect decision would result from failing to connect the certificate and endorsement with the requirement established by the contract.

For businesses, this means accurate extraction is necessary but insufficient. A reliable COI compliance system must determine how information in one document changes, supports, limits, or contradicts information in another.

"Cross-document reasoning tells the system what the complete evidence means, while grounding tells it which requirements that evidence must satisfy," Nunery said. "Remove either one, and the resulting determination is a guess wearing a confident tone."

Nunery advocates for grounded AI systems that evaluate related insurance documents as one body of evidence. A system should determine whether a required endorsement exists, applies to the correct policy, names the appropriate legal entity or project, and satisfies the governing contract. It should also recognize when amendments, schedules, project requirements, or approved exceptions change the compliance decision.

In practical terms, grounding establishes the compliance standard, while cross-document reasoning determines whether the available evidence actually meets that standard.

Why Traceable AI Decisions Matter in COI Compliance

Nunery argues that every AI-supported compliance determination should identify which requirement applied, which documents were evaluated, and why the system reached its conclusion.

"A compliance determination that cannot be reconstructed is not defensible, however confident the system sounded when it made it," Nunery said. "Auditability should be treated as a fundamental requirement for grounded AI, not an optional reporting feature."

Traceability becomes critical during audits, contractual disputes, and claims. A confidence score or pass-fail label does not establish that the system applied the correct agreement, reviewed the relevant endorsements, considered approved exceptions, or evaluated the complete evidence.

A traceable COI compliance decision should allow a reviewer to reconstruct the path from the governing requirement to the supporting documents and the resulting determination.

Human oversight must also remain part of the process. AI can accelerate reviews and identify potential deficiencies, but a person should approve a determination before a third party is declared compliant—particularly when evidence is incomplete, policy language is unusual, or an exception applies.

Seven Questions to Ask a Grounded AI Compliance Vendor

Nunery recommends focusing less on the underlying AI model and more on the requirements, evidence, and controls surrounding it. Buyers should ask:

- Who defines "compliant" in the system?

- Are requirements configured before the system operates at scale?

- Does the system connect certificates with contracts, endorsements, and schedules?

- Can it distinguish missing evidence from deficient coverage?

- Is every determination supported by documented reasoning?

- Does a person approve the decision before a vendor is declared compliant?

- Which capabilities are available today rather than planned for the future?

Nunery also recommends measuring both false passes and false failures. A false pass leaves uncovered risk in an organization's portfolio, while a false failure creates unnecessary work by prompting teams to pursue vendors that were not out of compliance.

The two measures reveal different types of system error: false passes indicate potential risk exposure, while false failures indicate unnecessary operational work and third-party friction.

"A system that reports only one of those numbers is telling you half of what happened," Nunery said.

How illumend Uses Grounded AI for COI Compliance

illumend is an AI-powered third-party insurance compliance and risk management platform backed by myCOI's institutional data foundation. Nunery founded myCOI more than 16 years ago, and the company's experience includes reviewing 45 million documents, managing 1.2 million agreements, and identifying 2 million coverage gaps before they became claims.

During onboarding, illumend configures an organization's insurance requirements based on standards derived from its contracts and leases. The platform then evaluates submitted evidence against the defined requirements, reviews endorsements with each submission, identifies specific deficiencies, manages renewals, and documents the reasoning behind each determination. A person signs off before a third party is notified of its compliance.

The workflow is designed to connect four components of a compliance decision: the organization's requirements, the submitted insurance evidence, the reasoning used to evaluate that evidence, and human approval of the final determination.

"Grounding AI in an organization's requirements is the right place to start, but it is only half the answer," Nunery said. "Risk and compliance leaders should demand systems that understand the complete compliance picture, apply the correct requirements consistently, and produce decisions that can withstand scrutiny when an audit, dispute, or claim occurs.