Worker Certification and COI Tracking Without the Manual Chase
New York City can fine you up to $5,000 for every untrained worker found on your site, and it can assess that penalty separately against the site owner, the permit holder, and the worker's employer, which the Department of Buildings has described as reaching $15,000 in stacked penalties for a single worker. There is a second fine of $2,500 that has nothing to do with whether the worker was actually trained. That one is for a permit holder who fails to maintain the training documentation log. The paperwork is a finable object all by itself, which is a useful way to understand what credential and certificate of insurance tracking really is on an enterprise project.
Most general contractors already know this. What they do not have is a way to answer the question at any moment, across every active site, without someone picking up a phone.
Your credentials expire faster than your workforce stays put
Every credential on a jobsite is a countdown clock, and almost none of them are synchronized. A New York City Site Safety Training card is valid for five years, and renewal has to be initiated in the twelve months before it expires. A powered industrial truck operator has to be re-evaluated at least once every three years, and that clock restarts early if the operator is assigned a different truck type or is involved in a near miss. Nevada requires construction workers to hold an OSHA-10 card and supervisors an OSHA-30 card within 15 days of hire, with the cards expiring after five years, and the statute directs the employer to suspend or terminate anyone who cannot present a current card.
Now put those clocks next to how long people actually stay. Median tenure with a current employer in construction was 4.2 years as of January 2024, and the construction total separations rate has run at or above 4.0 percent per month every year since 2021, higher than the private-sector average. The interesting part is that construction quits are actually below the private-sector rate. The churn is not people leaving the trade, it is crews demobilizing off one project and mobilizing onto the next, and every remobilization is a fresh verification event.
Here is what a single worker on an enterprise project can be carrying, each on its own schedule:
NYC SST card, 40 hours for workers and 62 for supervisors, valid five years, and validated in the Training Connect app before the worker is allowed entry
OSHA 10 or OSHA 30, mandated statewide in Nevada and on publicly funded work in several other states
Powered industrial truck certification, re-evaluated every three years or sooner on a triggering event
Fall protection training, retrained whenever conditions, systems or equipment change
Competent person designations, which are role-based rather than card-based and travel with the assignment
Site-specific orientation, which resets every time the worker moves to a new project
The card outlasts the employment relationship, which is exactly why credential tracking cannot live in an employer's filing cabinet. It has to live at the site, attached to the person, and it has to be checked at the gate rather than reconstructed after an inspector asks.
OSHA does not just require training, it requires a record it can read
This is the part that gets missed. The federal fall protection training standard, 29 CFR 1926.503(b), does not stop at "train the worker." It requires a written certification record containing the name or other identity of the employee trained, the date or dates of the training, and the signature of the person who conducted it or of the employer, and it requires you to keep the most recent certification on file. The powered industrial truck standard, 29 CFR 1910.178(l), asks for four fields: operator name, training date, evaluation date, and the identity of whoever performed the training or evaluation. These are database schemas written into federal regulation.
The citation data shows how often that record is the thing that fails. In OSHA's top 10 most-cited standards for fiscal year 2025, fall protection training under 1926.503 came in at 1,907 violations and powered industrial trucks under 1910.178 at 1,826, as reported by the National Safety Council. That is roughly 3,700 citations in a single year attached to standards whose core requirement is documentation of who was trained, when, and by whom. Those counts are preliminary, based on an August 2025 data snapshot, so treat them as directional rather than final.
The financial exposure attached to a missing record is fixed and public. OSHA's May 2026 penalty memorandum confirms the 2026 maximums:
$16,550 per serious violation
$16,550 per other-than-serious violation
$16,550 per day for failure to abate
$165,514 per willful violation
$165,514 per repeated violation
There is a detail in that memo worth knowing, because most published content has it wrong. There is no inflation increase for 2026. The 2025 amounts carried forward, because OMB cancelled the adjustment after BLS could not produce October 2025 CPI-U data. The number did not move, but the exposure did not shrink either, and a repeat citation on a training standard you were cited for two years ago is still priced at six figures.
A certificate of insurance is not proof that coverage exists
Every COI you have ever collected says so on its own face. The ACORD 25 form states that the certificate "is issued as a matter of information only and confers no rights upon the certificate holder," and that it "does not affirmatively or negatively amend, extend or alter the coverage afforded by the policies." It is a snapshot of what an agent believed to be true on the day it was typed. It is not the policy, it does not create additional insured status, and it does not survive the policy being cancelled the following week.
Courts have been unambiguous about what happens when a GC relies on the certificate instead of the underlying contract and endorsement. In Gilbane Building Co./TDX Construction Corp. v. St. Paul Fire & Marine Insurance Co., 31 N.Y.3d 131 (2018), New York's highest court held that a construction manager was not an additional insured under a subcontractor's blanket endorsement, because there was no written agreement directly between the construction manager and the named insured. The endorsement existed. The certificate existed. The privity did not, and the coverage evaporated. Katten's construction practice walked through the same failure pattern again in March 2025, noting that courts read the endorsement and the contract, never the certificate.
The exposure is not limited to defense costs on a liability claim. Under North Carolina's statutory employer provision, N.C. Gen. Stat. Section 97-19, a general contractor becomes directly liable for workers' compensation benefits to an uninsured subcontractor's injured employee unless it obtained a valid, current certificate before work began. In Suazo v. Gutierrez-Bojorquez, the contractor knew the sub's policy was about to lapse, let the work continue anyway, and was held liable as the statutory employer because no current certificate was on file at the time of the injury. Most states have an analogous provision with different mechanics, so the specific citation varies, but the principle does not.
Three practices follow from all of this, and Stoel Rives set them out in its 2026 best practices guidance for construction project insurance:
Get the policy, not just the certificate. A COI will not show you the endorsements that exclude coverage, and residential, condominium and mold exclusions are common enough that assuming their absence is a real risk.
Track the expiration, not the receipt. The compliance question is whether coverage is in force today, not whether a certificate arrived at buyout.
Keep the evidence through the statute of repose, not through closeout. In many jurisdictions that means being able to reproduce the coverage record six to ten years after the project is finished.
A 2021 analysis by the identity verification firm Evident ID found that 75 percent of third-party vendors did not meet the insurance requirements of the companies that hired them, and that roughly one in ten fell out of compliance without notifying the hiring company. That figure is vendor-published and not construction-specific, so treat it as an indicator rather than a benchmark. The direction it points is consistent with what every GC risk manager already suspects, which is that the certificate on file and the coverage in force are two different facts.
What tracking without the chase actually looks like on a BiltOn site
BiltOn is built so that the credential check happens at the moment of entry rather than in a spreadsheet review three weeks later. Worker Profiles and Credential Tracking create a single source of truth for identity, credentials and skills, so every certification is attached to a verified person rather than to a name on a sign-in sheet. Site access runs through 3D facial verification and SMS or QR-based orientation, which means the platform knows who is on site, what they are credentialed for, and whether that credential is current, at the moment they arrive. Document Management holds the supporting records, including DOB filings, DOT records, SDS and permits, in one retrievable place instead of across a dozen trailers.
That record then flows into the systems your project teams already run. BiltOn syncs two ways with Procore and Autodesk, both partners, pushing attendance, pre-shifts, orientations, permits and certificates of insurance into the system of record so the daily log reflects a verified worker rather than a recollection. David Rivera, Director of Operations at Broadway Construction Group, described what that is worth when a claim arrives: "I was able to go through BiltOn and show when all of these individuals clocked in and clocked out of job sites, and that information assisted general counsel in combing for verifiable truth." BCG runs roughly $900 million under management on a single access control and credentialing standard with about six central-office staff.
The measured effect across the BiltOn client base is administrative rather than dramatic, which is the point:
15 to 20 hours per week of administrative time returned, client-reported
54 percent reduction in administrative work per project, client-reported
37 percent increase in safety log and checklist completion within three months of deployment, client-reported
25 percent more worker orientations captured, client-reported
At Lettire, weekly administrative time fell from 20 hours to 5, and compliance gaps fell from 12 percent to 2 percent, client-reported
Greg Stewart, Director of Preconstruction and Operations at Lettire, framed the cost of getting this wrong in a way that lands with anyone who has run a site: "If your safety guy is stuck onboarding instead of walking the site, that's a gap in your coverage." The chase is not just an administrative annoyance. It consumes the hours of the person whose actual job is to be in the field.
The executive case: this is a bid qualifier, not a back-office task
Documented compliance is now a precondition for being allowed to bid, not just a defense after something goes wrong. Owners and their brokers screen contractors on experience modification rate alongside OSHA 300 logs, citation history, and the quality of the safety program and training records, and an EMR above 1.25 has long been treated as a red flag in prequalification. The pressure behind that screening is getting worse rather than better. NCCI's 2026 State of the Line shows construction is the largest workers' compensation industry by premium volume at 27 percent, and while construction posted the largest frequency decline of any industry between accident years 2023 and 2024, lost-time medical claim severity rose 13 percent over the same period. Fewer claims are costing more.
The rest of the industry is already routing this work to automation. AGC of America's 2026 Construction Hiring and Business Outlook found that 61 percent of firms use AI or plan increased AI investment, up from 44 percent a year earlier, and that office and administrative functions are the single largest use case at 45 percent, ahead of estimating, design and recruiting. Back-office compliance is where construction is actually deploying AI, and credential and certificate tracking is the clearest example of work that should never have required a human to chase it.
For enterprise general contractors, the case closes on three facts that are all verifiable. Credentials expire on schedules that outlast employment relationships. Federal training standards require retrievable per-worker records, and roughly 3,700 citations a year land on exactly that requirement. Certificates of insurance are informational documents that courts do not treat as coverage. Any one of those is a reason to stop tracking this by hand. Together they make the manual chase an unfunded liability sitting on your safety team's calendar.
Frequently asked questions
Does an OSHA 10 or OSHA 30 card expire? Federal OSHA does not set an expiration date on the card itself. State and local mandates do. Nevada requires renewal every five years under NRS 618.983, and New York City's SST card, which incorporates OSHA 30, is valid for five years with renewal initiated in the final twelve months. Many owners and GCs also impose their own refresher intervals by contract.
How long is an SST card valid in New York City, and how do you renew it? An SST card is valid for five years. Renewal must be initiated during the twelve months before expiration, and supervisors need 16 renewal hours. Every submitted SST card must be validated in the Training Connect app before the worker is allowed to enter the worksite, per the NYC Department of Buildings.
What are the penalties for having an untrained worker on a NYC construction site? Up to $5,000 per untrained worker, assessable separately against the site owner, the permit holder and the worker's employer. A permit holder that fails to maintain the required training documentation log faces an additional $2,500 penalty. DOB has described the stacked exposure as reaching $15,000 for a single untrained worker.
What records does OSHA require to prove a worker was trained? For fall protection, 29 CFR 1926.503(b) requires a written certification record with the employee's name or other identity, the training dates, and the signature of the trainer or employer, with the most recent certification kept on file. For powered industrial trucks, 29 CFR 1910.178(l) requires the operator name, training date, evaluation date, and the identity of the person who trained or evaluated.
How often does a forklift operator need to be recertified? An evaluation of each powered industrial truck operator's performance is required at least once every three years. Refresher training is triggered earlier by unsafe operation, an accident or near miss, a failed evaluation, assignment to a different type of truck, or a change in workplace conditions.
Does a certificate of insurance make me an additional insured? A certificate of insurance does not create additional insured status on its own. The ACORD 25 certificate confers no rights on the certificate holder and does not amend the policy. Additional insured status comes from the endorsement plus, in most blanket endorsements, a written contract directly between the named insured and the party claiming coverage, which is the issue that decided Gilbane v. St. Paul.
How long should I keep subcontractor COIs after a project closes out? You need to keep them well past closeout. Construction counsel recommends maintaining the insurance tracking record through the applicable statute of repose, which in many jurisdictions runs six to ten years or more past substantial completion, per Stoel Rives.
References
New York City Department of Buildings. Site Safety Training (SST) Frequently Asked Questions. https://www.nyc.gov/site/buildings/safety/sst-frequently-asked-questions.page
New York City Department of Buildings. Buildings News, October 1, 2018. https://www.nyc.gov/assets/buildings/newsletters/DOB_BN_100118.html
U.S. Department of Labor, OSHA. 29 CFR 1926.503, Fall Protection Training Requirements. https://www.osha.gov/laws-regs/regulations/standardnumber/1926/1926.503
U.S. Department of Labor, OSHA. 29 CFR 1910.178, Powered Industrial Trucks. https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.178
U.S. Department of Labor, OSHA. Top 10 Most Frequently Cited Standards. https://www.osha.gov/top10citedstandards/
National Safety Council. OSHA Top 10 Safety Violations Show Persistent Risk, September 16, 2025. https://www.nsc.org/newsroom/osha-top-10-safety-violations-show-persistent-risk
U.S. Department of Labor, OSHA. 2026 Annual Adjustments to OSHA Civil Penalties, May 21, 2026. https://www.osha.gov/memos/2026-05-21/2026-annual-adjustments-osha-civil-penalties
Nevada Revised Statutes. NRS 618.983, Construction Industry Safety Training Cards. https://law.justia.com/codes/nevada/chapter-618/statute-618-983
U.S. Bureau of Labor Statistics. Employee Tenure in 2024, September 2024. https://www.bls.gov/news.release/pdf/tenure.pdf
U.S. Bureau of Labor Statistics. Job Openings and Labor Turnover Survey, Table 20: Total Separations Rates by Industry. https://www.bls.gov/news.release/jolts.t20.htm
U.S. Bureau of Labor Statistics. Job Openings and Labor Turnover Survey, Table 22: Quits Rates by Industry. https://www.bls.gov/news.release/jolts.t22.htm
ACORD. Certificate of Liability Insurance, Form 25 (rev. 12/2025), hosted by the New York State Department of Financial Services. https://www.dfs.ny.gov/system/files/documents/2025/12/acord-25-2025-12-liability.pdf
Gilbane Building Co./TDX Construction Corp. v. St. Paul Fire & Marine Insurance Co., 31 N.Y.3d 131 (N.Y. Ct. App. 2018). https://law.justia.com/cases/new-york/court-of-appeals/2018/22.html
Katten Muchin Rosenman LLP. Are You Really Covered as an Additional Insured?, March 13, 2025. https://katten.com/are-you-really-covered-as-an-additional-insured
Teague Campbell Dennis & Gorham LLP. Contractor and Subcontractor Liability in Workers' Compensation: Who Is the Statutory Employer?, August 31, 2021. https://teaguecampbell.com/contractor-and-subcontractor-liability-in-workers-compensation-who-is-the-statutory-employer/
Stoel Rives LLP. 2026 Best Practices for Construction Project Insurance, January 15, 2026. https://www.stoel.com/insights/publications/2026-best-practices-for-construction-project-insurance
Evident ID, via BusinessWire. Significant Shortfalls in Third-Party Insurance Coverage Detailed in New Report, June 23, 2021. https://www.businesswire.com/news/home/20210623005183/en/Significant-Shortfalls-in-Third-Party-Insurance-Coverage-Detailed-in-New-Report
Safety+Health Magazine, National Safety Council. Screening for Safety. https://www.safetyandhealthmagazine.com/screening-for-safety/
NCCI. 2026 State of the Line Guide. https://www.ncci.com/SecureDocuments/SOLGuide_2026.html
Associated General Contractors of America and Sage. 2026 Construction Hiring and Business Outlook. https://www.agc.org/sites/default/files/users/user21902/2026%20Construction%20Hiring%20and%20Business%20Outlook%20Report_Final2.pdf
Stay Informed
Get the latest safety intelligence insights.
Join safety leaders and risk professionals who rely on BiltOn's newsletter for industry insights, research, and best practices.