KSeF (National e-Invoicing System) has brought revolutionary changes to the way Polish businesses issue invoices. From the beginning of 2022 the system was a voluntary option, and since 2026 it has been mandatory: from 1 February 2026 for taxpayers whose sales including tax exceeded PLN 200,000,000 in 2024, and from 1 April 2026 for everyone else (Article 106ga section 1 and Article 145l of the VAT Act). A key element of using KSeF is granting permissions correctly, so that authorised people can issue e-invoices on the taxpayer's behalf.
Granting permissions in KSeF requires an understanding of complex legal rules and of the practical aspects of using the system. Taxpayers need to know who can receive permissions, how to grant them and which documents are needed. Granting permissions incorrectly can cause problems with issuing structured invoices, which in turn may affect the company's cash flow.
Structured invoices issued through KSeF have the same legal value as paper or electronic invoices. The difference is that e-invoices can be issued only through the dedicated electronic interface of the National e-Invoicing System
What structured invoices in KSeF are
Structured invoices, also called e-invoices, are a modern form of accounting documentation with exactly the same legal value as traditional paper or electronic invoices. The key difference is how they are issued – e-invoices can be created only through the National e-Invoicing System, using a dedicated electronic interface.
Under Article 106na section 1 of the VAT Act, an e-invoice is deemed to be issued on the day it is sent to the National e-Invoicing System. This moment is crucial for determining when the tax point arises and the VAT payment deadlines. Taxpayers must remember that the issue date of an e-invoice is not the moment it is created in the system, but the moment it is actually sent to KSeF.
During the voluntary period (until 31 January 2026), receiving e-invoices through KSeF required the recipient's acceptance. Since 1 February 2026 no consent has been needed – a structured invoice is received through KSeF on the day its number is assigned in the system (Article 106gb section 1 and Article 106na section 3 of the VAT Act). The exceptions, where the invoice is made available to the buyer in a manner agreed with them, cover, among others, consumers and foreign entities (Article 106gb section 4).
Under Article 106nb of the VAT Act, the National e-Invoicing System may be used by taxpayers, entities designated by them, entities referred to in Article 106c and individuals named in a notification of granting permissions
KSeF can be used by various categories of users. The core group consists of VAT taxpayers, who can use the system directly. In addition, taxpayers may designate other entities or individuals to use KSeF on their behalf. The list of authorised users also includes the entities referred to in Article 106c of the VAT Act and individuals designated by those entities.
A special category consists of individuals named in a notification of granting permissions to use KSeF. These people receive permissions from the taxpayer or from the entities referred to in Article 106c and may act within the powers given to them. Permissions can also be delegated further – individuals using KSeF may designate other entities as authorised, if this follows from the permissions granted to them.
A general partnership (spółka jawna) decided to issue e-invoices and designated one of its partners as the entity authorised to issue them. The partner obtained the permission to use the interface and to issue structured invoices on behalf of the partnership, even though for VAT purposes they are treated as a separate taxpayer from the partnership.
Legal basis for granting KSeF permissions
The delegation in Article 106r of the VAT Act is the legal basis for issuing detailed rules on the use of the National e-Invoicing System. On this basis, the Regulation of the Minister of Finance and Economy of 12 December 2025 on the use of the National e-Invoicing System was issued (Journal of Laws (Dz.U.) 2025 item 1815, amended by Dz.U. 2026 item 169). From 1 February 2026 it replaced the Regulation of the Minister of Finance of 27 December 2021 and comprehensively governs the granting of permissions.
The Regulation sets out the types of permissions to use KSeF, the ways of granting and revoking permissions and the methods of authentication. It also contains a template notification of granting or revoking permissions, which standardises communication between taxpayers and the tax administration. These rules are intended to ensure that the e-invoicing system works in a uniform and secure way.
Under § 4 section 1 of the Regulation, permissions are granted and revoked using the KSeF interface software (its address is published by the Ministry of Finance; information is also available at ksef.podatki.gov.pl). This solution centralises the process and keeps it secure by using the official platform of the tax administration.
KSeF can be used both by individuals and by entities other than individuals. An essential condition is that the taxpayer authenticates in the system using the available identity verification methods
KSeF has been designed with different types of users in mind, so it takes into account how both individuals and legal entities operate. Every type of user must go through authentication, which protects the system and makes it possible to identify correctly the people authorised to issue e-invoices.
Authentication is the foundation of the security of the whole KSeF system. Taxpayers must use one of the available identity verification methods, and the system also checks the permissions held (§ 6 section 1 of the Regulation), which limits access by unauthorised persons. The variety of authentication methods allows the process to be adapted to the technical capabilities of different users.
Information required when granting permissions
Granting permissions in KSeF requires a number of detailed pieces of information, which are needed to identify correctly the taxpayer and the person or entity receiving the permissions. The first required element is the NIP (tax identification number) of the taxpayer granting the permissions. The NIP is the basic identifier of a taxpayer in the Polish tax system.
Another key element is the details of the entity or individual receiving the permissions. For entities, the NIP and the name of the entity are required. For individuals, you need to give their NIP or PESEL (national ID number) and their first name and surname.
The system also covers situations where an individual has neither a NIP nor a PESEL number. In such cases their date of birth is required. In addition, where the person has neither a NIP nor a PESEL, you must give the number and series of their identity card or another identity document, together with the country of issue.
Where a qualified electronic signature is used that does not contain a NIP or a PESEL number, unique data identifying that signature must be provided. This information is necessary for correct authentication in the system
Particular attention should be paid to situations where the authorised individual uses a qualified electronic signature. If that signature does not contain a NIP or a PESEL number, the system requires unique data identifying the signature. This makes it possible to verify identity even without the standard identifiers.
Apart from identification data, the system requires you to specify the type of permission granted to the person or entity. The various types of permissions may cover issuing invoices, accessing invoices, granting further permissions or revoking them. Defining the scope of permissions precisely is key to the system working properly.
The last required element is information on whether the entity or individual receiving the permissions is a tax representative within the meaning of Article 18a of the VAT Act. This information matters for determining the scope of responsibility and the way VAT is settled.
Ways of granting KSeF permissions
The basic way of granting KSeF permissions is to use the electronic KSeF interface, for example the free KSeF Taxpayer Application (Aplikacja Podatnika KSeF) of the Ministry of Finance. This method is preferred because it is fast, convenient and automated. However, granting permissions electronically requires suitable tools for authenticating in the system.
To authenticate electronically in KSeF, you can use a qualified electronic signature, which provides the highest level of security. Alternatively, taxpayers can use a qualified electronic seal, which is particularly useful for legal entities. Another option is an electronic identification means from the national node (login.gov.pl), such as the Trusted Profile (Profil Zaufany), which is widely used in dealings with public administration – in KSeF since 14 February 2026 (§ 6 section 1 and § 15 of the Regulation).
After authenticating in one of these ways, you can generate a KSeF certificate, valid for no longer than 2 years (§ 6 section 1 point 4 and section 2 of the Regulation). KSeF tokens under the previous rules can be used for authentication only until 31 December 2026 (§ 13 section 1 point 1)
For taxpayers other than individuals who cannot authenticate with a qualified electronic seal, there is a method based on the ZAW-FA notification (the form notifying the tax office of granting or revoking KSeF permissions), filed with the head of the tax office (urząd skarbowy) (§ 5 section 1 of the Regulation) – on paper or through the e-Tax Office (e-Urząd Skarbowy). A ZAW-FA designates one individual; another can be designated only after the previous person's permissions have been revoked (§ 5 section 3). An individual running a business logs in to KSeF themselves, for example with the Trusted Profile or a qualified electronic signature.
It follows from § 5 section 1 of the Regulation that taxpayers other than individuals who hold a qualified electronic seal containing their NIP may use KSeF on the basis of original owner permissions. In such cases there is no need to report permissions to the tax office, which greatly simplifies the process.
In other situations, a taxpayer that is not an individual must use the ZAW-FA notification to designate an individual authorised to use KSeF on its behalf. That person can then grant further permissions electronically, directly in KSeF.
A civil-law partnership (spółka cywilna) registered for VAT did not have a qualified seal and wanted to appoint an employee of its accounting department to issue e-invoices. The partnership filed a ZAW-FA notification naming a specific individual to use KSeF, including granting permissions, revoking permissions, issuing invoices and accessing invoices on behalf of the entity.
Granting permissions step by step
Granting KSeF permissions requires a systematic approach and following a set procedure. The process differs depending on whether the taxpayer uses the electronic interface or the ZAW-FA notification.
- Preparing the necessary documents and identification information
- Choosing the right authentication method in the system
- Logging in to KSeF, for example in the KSeF Taxpayer Application
- Completing the permission form with the required data
- Specifying the type and scope of the permissions granted
- Checking the data entered before confirming
- Sending the request for granting permissions to the system
- Waiting for confirmation that the permissions have been granted
For taxpayers using the electronic interface, the process starts with logging in to the system using one of the available authentication methods. After logging in, the user has access to the permission form, in which they must enter all the required information about the person or entity receiving the permissions.
Particular care should be taken to fill in all fields of the form correctly. Errors in personal data, identification numbers or the scope of permissions may lead to the request being rejected or to problems with using the system later.
Checking the data entered before confirming the request is key to avoiding problems. The system may check some data automatically, but the taxpayer is responsible for its completeness and correctness
After the request is sent, the system generates a confirmation that the permissions have been granted. KSeF notifies the entities concerned of the permissions granted (Article 106nd section 2 point 2 of the VAT Act), and the person or entity that received the permissions can log in to the system straight away.
Using the ZAW-FA notification takes more time – the document must be filed with the competent tax office (on paper or through the e-Tax Office) and you have to wait for it to be processed. The form (version ZAW-FA(3) since 1 February 2026) must contain all the required information, including mandatory e-mail addresses, and the signatures of the persons authorised to represent the taxpayer (§ 5 section 2 of the Regulation).
Types of permissions in KSeF
The Regulation (§ 3 section 1) lists four types of permissions: to grant and revoke permissions, to issue or access invoices, for invoices to be issued by the buyer (self-billing, Article 106d section 1 of the VAT Act) and to issue VAT RR invoices (invoices for purchases from flat-rate farmers). They are granted depending on the taxpayer's needs and the role of the person or entity receiving them. The basic permission is the ability to issue structured invoices on behalf of the taxpayer. This permission makes it possible to create e-invoices and send them to recipients through KSeF.
Another important permission is access to the invoices stored in the system. People with this permission can view, download and manage invoices issued or received by the taxpayer. This permission is particularly useful for accountants, who need access to documents in order to keep the books.
The permission to grant further permissions allows the person receiving it to delegate some of their powers to other people or entities. This is particularly useful in larger organisations, where different people may be responsible for different aspects of using the e-invoicing system.
In the Regulation, granting and revoking permissions is a single permission (§ 3 section 1 point 1). Revoking is as important as granting – it allows you to withdraw system access from people who should no longer use KSeF on the taxpayer's behalf
The scope of permissions can be matched to tasks – for example, one person receives only access to invoices, while another can also issue them. The Regulation does not, however, provide for permissions granted in advance for a fixed period – when access is no longer needed, the permission must be revoked. This approach increases system security and gives better control over the e-invoicing process.
Some permissions can be combined, which means that one person can hold several different permissions at the same time. For example, a chief accountant may receive permissions to issue invoices, access invoices and grant permissions to other employees of the accounting department. When an accounting office keeps the books, granting it access to invoices is enough – that is how we work with clients of our accounting services.
| Type of permission | Description | Typical user | Scope of responsibility |
|---|---|---|---|
| Issuing invoices | Creating e-invoices in the system | Accountant, salesperson | Generating documents |
| Access to invoices | Viewing and downloading | Accountant, controller | Analysing documentation |
| Granting and revoking permissions | Delegating and withdrawing access | Manager, owner | Access management |
| Self-billing (Article 106d) | Issuing invoices on behalf of the seller | Buyer and the people it designates | Invoices on behalf of the seller |
Managing permissions in practice
Effective management of permissions in KSeF requires a well-thought-out strategy and regular monitoring. Taxpayers should develop internal procedures setting out who can receive permissions, for how long and to what extent. Such procedures should reflect the specifics of the organisation and its security requirements.
Regular reviews of permissions are essential for keeping the system secure. Taxpayers should periodically check whether everyone holding permissions still needs access to KSeF and whether the scope of their permissions matches their role. Particular attention should be paid to situations where employees change positions or leave the organisation.
Documenting the permissions granted is as important as granting them. Taxpayers should keep registers of authorised persons with information on the date permissions were granted, their scope and the person responsible for granting them. Such documentation may be useful during a tax audit or if there are problems with the system.
Permissions in KSeF can be changed at any time, in the same way as they are granted – by granting a new permission or revoking an existing one. Taxpayers can extend or restrict the scope of permissions as their needs change
The rules do not provide for temporarily suspending permissions – the Regulation only covers granting and revoking them (§ 4 section 1). When an authorised person is absent for a longer time or there are doubts about the security of their access, it is safer to revoke the permission and grant it again when they return; done electronically, this usually takes a moment.
Monitoring the activity of authorised persons is another important aspect of management. KSeF marks each invoice with an identification number and reports the date and time it was issued (Article 106nd section 2 points 8 and 10(a) of the VAT Act), and the taxpayer can see the list of permissions granted. Regularly reviewing the invoices issued and the permissions can help detect irregularities or abuse.
Security and responsibility in KSeF
Security issues in KSeF are of fundamental importance because of the sensitivity of financial data and the legal consequences of issuing invoices. As a rule, taxpayers are responsible for the actions of the people to whom they have granted permissions to use the system. This means that every e-invoice issued by an authorised person is treated as if it had been issued by the taxpayer itself.
System security rests on several pillars, the most important being proper user authentication. Using qualified electronic signatures, electronic seals or Trusted Profiles gives a high level of security. Taxpayers should make sure that authorised persons properly protect their authentication tools.
The protection of personal and business data in KSeF is governed by the GDPR and by specific rules on public administration IT systems. Taxpayers must ensure that authorised persons are aware of their data protection obligations and apply appropriate security measures.
A security breach in KSeF can lead not only to tax problems but also to liability for a personal data breach. Taxpayers should implement appropriate security procedures and train authorised persons
Responsibility for e-invoices issued by authorised persons covers both tax and civil law aspects. Errors in invoices, incorrect VAT settlements or missed invoicing deadlines may lead to financial penalties and additional obligations towards the tax authorities.
KSeF provides access control mechanisms that help reduce the risk of abuse. Taxpayers can configure permissions so that authorised persons have access only to the functions they need, for example only to viewing invoices without the right to issue them.
Most common problems and how to solve them
In practice, taxpayers using KSeF encounter various problems related to granting permissions. One of the most common is errors in the data entered when granting permissions. Incorrect NIP numbers, errors in first names and surnames or an incorrectly defined scope of permissions may lead to the request being rejected or to login problems.
Technical problems with authentication are another common category of difficulty. People trying to access the system may run into problems with qualified electronic signatures, Trusted Profiles or tokens. In such cases it may be necessary to contact the authentication service provider or KSeF technical support.
Delays in granting permissions may result from system overload or the need for additional data verification. Especially when the ZAW-FA notification is used, the process may take much longer than granting permissions electronically.
The same person may hold permissions from different taxpayers – for example, an accountant serving several companies. When logging in, they then choose the context, that is, the taxpayer on whose behalf they are acting, so it is worth checking on whose behalf an invoice is being issued
Problems with revoking permissions may arise when the authorised person does not cooperate or has no access to the system. Revoking a permission does not, however, require their involvement – it is done by the taxpayer or by a person holding the permission to grant and revoke permissions, and permissions of a person designated through ZAW-FA are revoked with another ZAW-FA notification. The taxpayer's owner permissions cannot be revoked.
Errors in defining the scope of permissions may lead to a situation where the authorised person cannot perform the expected actions or has access to functions they should not use. Solving such problems requires changing the permissions, which can take time.
- Checking that the data is correct before sending the request for permissions
- Testing system access by newly authorised persons
- Regularly updating authentication tools
- Documenting all permissions granted and changes to them
- Training authorised persons in using the system
- Monitoring activity in the system for irregularities
The future of KSeF and permissions
The obligation to use KSeF is already in force, so all businesses covered by it must master the process of granting permissions. Until 31 December 2026 some exceptions still apply: taxpayers whose sales documented with invoices in a given month do not exceed PLN 10,000 gross may issue invoices outside KSeF (Article 145m of the VAT Act), as may taxpayers issuing invoices from cash registers (Article 145n).
From 1 January 2027 penalties apply for failing to issue an invoice in KSeF (Article 106ni of the VAT Act). Before that date, it is therefore worth checking that the people issuing invoices hold the right permissions and that access for people who no longer work at the company has been revoked.
Authentication methods in KSeF have also changed. The trusted signature (podpis zaufany) could be used until 13 February 2026, logging in through the national node (for example with the Trusted Profile) has worked since 14 February 2026, and tokens can be used only until 31 December 2026 (§ 13 and § 15 of the Regulation). For accounting systems and integrations, they are being replaced by KSeF certificates, which must be renewed at least every 2 years.
If your invoicing software connects to KSeF with a token, before 31 December 2026 you need to switch to a KSeF certificate or another authentication method under § 6 of the Regulation – otherwise the software will lose access to the system from 2027
At European Union level, the VAT in the Digital Age (ViDA) package has been adopted, providing for the gradual harmonisation of e-invoicing in transactions between Member States. This may affect the national rules on KSeF in the future, but it does not change the current rules for granting permissions.
The Ministry of Finance publishes materials on KSeF (including manuals and answers to questions at ksef.podatki.gov.pl), which help taxpayers grant permissions correctly and use the system. Small businesses in particular, which can use the exceptions until the end of 2026, should read them before 1 January 2027.
