Certificate of currency automation handles the loop between an inbound request for proof of insurance and the certificate going back out: reading the request, identifying the right policy, checking it is current, generating or retrieving the certificate, and replying. It is the single most automatable task in an Australian brokerage, because every step is high-volume, rules-based, and requires almost no broker judgement — which is precisely why having a person do it is so expensive.
Why is the COC chase such a disproportionate drain?
Because it is relentless, interruptive, and invisible in every measure of brokerage performance.
A certificate of currency proves cover is in force. Principals want one before a contractor sets foot on site. Landlords want one before a lease is signed. Head contractors want one before releasing payment. Councils want one attached to a permit. None of these people are your client, all of them are blocking your client, and every one of them is entitled to ask.
The requests arrive by email, in no particular format, from addresses nobody recognises, and they are almost always urgent because the person asking has been waiting on something else. A brokerage with a few hundred commercial policies fields these constantly.
What makes them expensive is not the two minutes each one takes. It is that they arrive during the work that does earn commission. An account manager preparing a renewal who stops to pull a certificate loses far more than the two minutes — and this happens several times a day. The task looks trivial in isolation and eats a genuine fraction of the week in aggregate.
There is also a client-experience cost nobody measures. A COC request that sits until tomorrow because everyone was busy is a client whose settlement or site access is delayed by their broker. Clients remember that far longer than they remember a smooth renewal.
What does the automated loop actually do?
Five steps, and each one is mechanical.
Read the request. An inbound email asking for proof of cover, in whatever phrasing the requester used. This is the one step where language understanding earns its place — the requests are unstructured, and pattern-matching on subject lines fails constantly.
Identify the policy. Match the request to a client and a specific policy. Sometimes the requester names it exactly; more often they name the insured business and the certificate type, and the system has to resolve which policy they mean. Where the match is ambiguous — two policies could satisfy the request, or the requester is vague — the system routes to a human instead of guessing. Guessing here means sending someone else's policy details to a third party, which is the one outcome worth engineering hard against.
Check currency. Confirm the policy is actually in force for the period the certificate will assert. This step is not optional and it is where an otherwise-good automation can do real damage: issuing a certificate for a lapsed policy is a false statement about cover, made by your brokerage, to a party relying on it.
Generate or retrieve. Pull the certificate from the insurer portal or generate it from your system, depending on the class and the insurer.
Reply. Send it back to the requester, copy the client so they know it went out, log the whole exchange against the policy.
Steps two and three are where the design work lives. The rest is plumbing.
What is it worth in dollars?
Take a brokerage fielding 25 COC requests a week — realistic for a few hundred commercial policies, and low for anyone with a construction-heavy book.
Each one, done manually, is about 6 minutes of actual handling: read it, work out which policy, check it is current, pull the certificate, write the reply, log it. That is 2.5 hours a week. But the honest figure is higher, because these arrive as interruptions to other work, and the recovery cost of a broken task is real even if it never appears on a timesheet. Call the true cost 4 hours.
Automated, what remains is the exceptions: ambiguous matches, unusual requests, anything where currency is in question. Perhaps 15% of volume needs a human, at the same 6 minutes. That is about 20 minutes a week.
You have recovered roughly 3.5 hours every week, around 180 hours a year. At a loaded $55/hour that is close to $10,000 annually, from automating a task nobody in the brokerage would defend as a good use of their time. On our usual $2,000–$15,000 AUD range for an automation build, a narrow workflow like this is at the lower end and pays for itself inside the first year.
The second-order benefit is faster than the arithmetic suggests. Requests answered in minutes rather than next-Tuesday changes what clients think of you, and it is the kind of thing that gets mentioned when they are asked to recommend a broker.
Where does it go wrong?
Three ways, all avoidable, all worth designing against explicitly.
Sending the wrong policy. The failure mode with real consequences. A request that could plausibly match two policies must go to a human. Build the ambiguity threshold conservatively — you want a system that escalates too often at first, then tighten it once you have seen real traffic. The cost of an unnecessary escalation is two minutes; the cost of disclosing one client's cover to an unrelated third party is a privacy incident.
Certifying cover that is not in force. The currency check has to be a hard gate, not an advisory flag. Lapsed, cancelled, or mid-cancellation policies stop the workflow and route to a broker. No exceptions, no "probably fine".
Leaking who is asking. COC requests reveal commercial relationships — who a client works for, which sites they are on, which contracts they are bidding. That is client-confidential information, and much of it is personal information under the Privacy Act.
If the classification step runs through a third-party API, that context is leaving your control. The OAIC's guidance on commercially available AI products is explicit that privacy obligations apply to information entered into an AI system, not only to its outputs. And where that system sits offshore, s 16C of the Privacy Act makes you accountable for how the overseas recipient handles it.
Worth keeping in proportion: the OAIC recorded 1,205 data breach notifications in 2025, an all-time high, with 716 attributed to malicious or criminal activity. Reducing the number of places your client data travels is not paranoia; it is the cheapest control available. That is the same argument we make about data sovereignty across regulated work.
How should a brokerage roll it out?
This is the ideal first automation for a brokerage precisely because the blast radius is small and the volume is high enough to prove the value quickly.
Start with one certificate type and one insurer, where the retrieval path is well understood. Run it in shadow mode first: the system does the full loop but drafts the reply for a human to send rather than sending it. You will find out fast how often it picks the right policy, and you will discover the quirks of your own data — the clients with six near-identical entities, the trading names that do not match the policy schedule.
When the match rate holds up over a few hundred real requests, let it send the routine ones and keep humans on the exceptions. Then widen to more certificate types and insurers.
Track two numbers, not one: hours saved, and the escalation rate. A system escalating 40% of requests is not working. A system escalating 2% is probably guessing.
If you want this scoped against your actual request volume and systems, that is the work we do in our insurance broker automation engagements.
Ready to get the COC chase off your desk?
If your account managers are pulling certificates between renewal calls, it is worth a conversation. Book a discovery call and we will map the request loop as it runs today, show you what the automated version handles and what it escalates, and give you the honest maths — built by the engineers who would run the project, with your data staying in Australia.
Sources
- OAIC, Guidance on privacy and the use of commercially available AI products (October 2024)
- OAIC, APP 8: Cross-border disclosure of personal information — s 16C accountability
- OAIC, Data breach notifications increase to all-time high in 2025 — 1,205 notifications, 716 malicious or criminal
- NIBA, Insurance Brokers Code of Practice
The volume and dollar figures above are worked arithmetic on stated assumptions, not survey data. Substitute your own request volume and loaded hourly cost.
