At risk construction management (CM-at-risk or CMAR) places the construction manager in a position similar to a general contractor. The CM guarantees a maximum price (GMP) and assumes financial risk for cost overruns. This delivery method has grown 18% since 2020 according to the Design-Build Institute of America, and now accounts for roughly 25% of public construction projects nationwide.

For GCs who serve as CM-at-risk firms, the compliance requirements shift significantly compared to traditional CM-agency roles. Insurance minimums increase. Bonding obligations change. Licensing requirements vary by state. This guide maps those requirements across key jurisdictions.

How At Risk Construction Management Differs from CM-Agency

In a CM-agency arrangement, the construction manager acts as the owner's advisor. The owner holds the trade contracts directly. The CM's liability is limited to professional negligence in their advisory role.

In at risk construction management, the CM holds the trade contracts. The CM provides a guaranteed maximum price. If costs exceed the GMP, the CM absorbs the difference. This structure means the CM-at-risk firm faces the same subcontractor management obligations as a traditional GC.

Insurance exposure increases. The CM-at-risk needs general liability coverage that mirrors a GC's policy, not a professional services policy. Additional insured requirements flow down to subcontractors just as they would on a GC-led project.

Bonding requirements apply. Many public projects require performance and payment bonds from the CM-at-risk, identical to bonds required from a GC on design-bid-build projects.

Licensing requirements shift. Some states require a general contractor license to serve as CM-at-risk. Others accept a construction management license or professional registration.

State-by-State At Risk Construction Management Requirements

State	License Required	Bonding for Public Projects	Insurance Minimums	GMP Requirement	Enabling Legislation
California	GC license (B classification)	Performance + payment bonds required	$2M GL, $1M per occurrence typical	Yes, required by statute	Public Contract Code 20133
Texas	No state GC license (local rules apply)	Bonds required over $100K (public)	$1M GL minimum typical	Yes, per contract	Government Code 2269
Florida	GC license (CGC or CBC)	Bonds required for public projects	$1M GL, $1M WC per occurrence	Yes, required by statute	Section 255.20 F.S.
New York	NYC requires GC license; state varies	Bonds required for public projects	$2M GL, $5M umbrella common	Yes, per contract	General Municipal Law 101
Colorado	No state GC license	Bonds required for public projects	$1M GL minimum typical	Yes, per contract	CRS 24-105-101
Georgia	GC license required	Bonds required over $100K (public)	$1M GL minimum typical	Yes, per contract	O.C.G.A. 36-91-2
Washington	GC registration required	Bonds required for public projects	$1M GL, WC required (state fund)	Yes, per contract	RCW 39.10
Virginia	GC license required (Class A over $120K)	Bonds required for public projects	$1M GL minimum typical	Yes, required by statute	Virginia Code 2.2-4382
Ohio	No state GC license	Bonds required for public projects	$1M GL minimum typical	Yes, per contract	ORC 9.33
Illinois	No state GC license (Chicago requires)	Bonds required for public projects	$1M GL minimum typical	Yes, per contract	30 ILCS 535

Case Study: CM-at-Risk Compliance in Florida

A mid-size firm based in Tampa won a CM-at-risk contract for a $45M county courthouse project. Here is how state-specific requirements shaped their compliance program.

Licensing

Florida requires a Certified General Contractor (CGC) license from the Construction Industry Licensing Board to serve as CM-at-risk. The firm's qualifying agent held an active CGC license, satisfying this requirement. They verified the license status through the DBPR online portal 30 days before the proposal deadline.

Bonding

The county required performance and payment bonds equal to 100% of the GMP. The firm secured bonds through their surety, which required updated financial statements showing the firm's bonding capacity could absorb a $45M obligation. The surety reviewed the firm's current backlog, work-in-progress, and completed project history before issuing the bonds.

Insurance Configuration

The contract required $2M general liability per occurrence, $4M aggregate, plus a $5M umbrella policy. The firm added the county as an additional insured using CG 20 10 and CG 20 37 endorsement forms. Workers' compensation was required for all employees, with no minimum headcount threshold (Florida requires WC for construction firms with 1+ employees for subcontractors, 4+ for non-construction).

Subcontractor Flow-Down

The firm flowed down insurance requirements to all 23 trade subcontractors. Each sub needed $1M GL per occurrence, workers' compensation, and auto liability. The firm used a compliance platform to track all 23 sets of certificates, verify endorsements, and monitor expiration dates.

GMP Management

The GMP was set at $45M after the design reached 60% completion. The contract included a shared savings clause: if the final cost came in under GMP, the county and the CM split the savings 75/25. This structure incentivized the CM to manage subcontractor costs aggressively while maintaining quality and compliance.

Key Compliance Differences by State

Licensing Variations

States fall into three categories for CM-at-risk licensing.

GC license required states (CA, FL, GA, VA, WA). These states treat CM-at-risk the same as general contracting. You need the same license to guarantee a price and hold trade contracts. Verify your license covers the project value threshold for the state.

No state license states (TX, CO, OH, IL). These states do not require a state-level GC license, though local jurisdictions may impose their own requirements. Chicago requires a general contractor license even though Illinois does not.

Hybrid states (NY). New York City requires a GC license, but projects outside the city may not. Check the specific jurisdiction for each project.

Bonding Thresholds

Most states require bonds on public CM-at-risk projects, but thresholds vary.

Georgia and Texas set the threshold at $100,000. Projects below this amount may not require bonds. California and Florida require bonds on all public CM-at-risk projects regardless of value.

Private CM-at-risk projects may or may not require bonds depending on the contract. Owners of large private projects increasingly require bonds from CM-at-risk firms.

Insurance Requirements

Insurance minimums for CM-at-risk work generally match GC requirements in each state. The key difference is that some owners require higher limits for CM-at-risk projects because the delivery method concentrates risk on a single entity.

New York public projects commonly require $5M+ umbrella coverage for CM-at-risk firms. California typically requires $2M-$5M depending on project size. Most other states require $1M-$2M.

Managing At Risk Construction Management Compliance

Build a state requirements matrix. Before pursuing CM-at-risk work in a new state, document the licensing, bonding, and insurance requirements. Compare them to your current capabilities. Gaps in licensing or bonding capacity can disqualify you from bidding.

Verify subcontractor compliance early. CM-at-risk projects often use a preconstruction phase to select subcontractors before the GMP is set. Start collecting COIs and verifying licenses during preconstruction, not after GMP approval. Late-stage compliance issues delay mobilization.

Track GMP against actual costs. Your compliance platform should link cost tracking to subcontractor management. If a trade package runs over budget, you may need to rebid the work. New subcontractors mean new compliance verification cycles.

Monitor bond capacity. Each CM-at-risk project consumes bonding capacity. Track your aggregate bond exposure across all active projects. Running close to your bonding limit restricts your ability to pursue new work.

Use your compliance scorecard to monitor subcontractor insurance status across all CM-at-risk projects. A single expired certificate on one project can trigger a default notice under the prime contract.

FAQs

What is at risk construction management? At risk construction management (CM-at-risk or CMAR) is a project delivery method where the construction manager provides a guaranteed maximum price (GMP) and holds the trade subcontracts directly. The CM assumes financial risk for cost overruns, unlike CM-agency where the owner holds the contracts and bears the cost risk.

Do I need a GC license for at risk construction management? It depends on the state. California, Florida, Georgia, Virginia, and Washington require a general contractor license to serve as CM-at-risk. Texas, Colorado, Ohio, and Illinois do not require a state-level GC license, though local jurisdictions may have their own requirements.

What insurance do I need for CM-at-risk projects? CM-at-risk firms typically need the same insurance as a general contractor: commercial general liability ($1M-$2M per occurrence), workers' compensation, auto liability, and umbrella/excess coverage. Public projects in New York often require $5M+ umbrella coverage. Specific requirements vary by state and project owner.

Are bonds required for at risk construction management? Most states require performance and payment bonds on public CM-at-risk projects. Thresholds vary: Georgia and Texas require bonds on projects over $100,000, while California and Florida require bonds on all public CM-at-risk projects regardless of size. Private projects may or may not require bonds.

How does the GMP work in at risk construction management? The GMP is set after design reaches a specified completion percentage (typically 50-75%). The CM guarantees that construction costs will not exceed this amount. If costs exceed the GMP, the CM absorbs the overage. Many contracts include shared savings clauses where the owner and CM split any cost savings below the GMP.

What is the difference between CM-at-risk and design-build? CM-at-risk separates design and construction into two contracts. The owner hires a designer directly and separately hires the CM-at-risk. In design-build, a single entity holds both the design and construction contracts. Both methods shift construction risk to the contractor, but design-build also shifts design risk.

Simplify Your CM-at-Risk Compliance

SubcontractorAudit helps CM-at-risk firms track subcontractor insurance, verify licenses, and monitor compliance across multiple projects and jurisdictions. Request a demo to see the platform in action.