How can an accounting office manage multiple clients in KSeF?

A firm with forty clients does not have one KSeF implementation after the mandate. It has forty separate permission configurations, forty NIP (Polish tax identification number) contexts, and forty document streams that keep flowing whether or not anyone looked at them today.

Since 1 April 2026 the obligation to issue structured invoices has covered most of the remaining VAT payers (the smallest from 1 January 2027), following the first wave on 1 February 2026 for the largest taxpayers. That part is behind us. Two dates ahead will change how firms work: 31 December 2026 ends the deferral for the smallest taxpayers who stay under the PLN 10,000 monthly threshold, and 1 January 2027 brings the smallest taxpayers into scope along with the requirement to quote the KSeF number in bank transfer titles.

Under the current act, penalties under Article 106ni of the VAT Act apply from 1 January 2027. On 16 September 2026 the Ministry of Finance announced it will move them to 1 January 2028; that is a bill not yet passed, and it moves only the penalties, not the obligation to use KSeF.

What follows is the practical layout: how to build an access model that scales to dozens of clients, and what a working day looks like when invoices arrive from many companies at once.

Three layers of access that get confused for one

The most common mistake in firm-side rollouts is treating "KSeF access" as a single thing. It is three independent layers:

1. Formal. Who on the client side can grant permissions at all. A JDG (Polish sole proprietorship) owner receives full owner permissions automatically upon authentication. A company without a qualified electronic seal must first file the ZAW-FA notification (version 3 applies from 1 February 2026), which designates the first individual holding the broadest permissions.

2. Permissions. What scope the client granted your firm inside KSeF: issuing invoices, accessing invoices, managing permissions.

3. Technical. What your accounting software authenticates with: a KSeF certificate or, in Biurko, also Profil Zaufany.

A mismatch between these layers is the usual reason a first send returns a 403. The client "signed everything", but nobody logged into the taxpayer application and actually granted the permission.

Indirect permissions: the model that scales

In the standard model a taxpayer grants two kinds of permissions: direct ones, to a named individual identified by NIP or PESEL (the Polish personal identification number), and indirect ones, to an entity such as an accounting firm, with the right to pass permissions further down. The rules come from the Regulation of the Minister of Finance and Economy of 12 December 2025 on the use of the National e-Invoicing System, and the Ministry publishes practical guidance in its KSeF 2.0 questions and answers.

The difference is operational, not cosmetic:

With indirect permissions, staff turnover no longer requires contacting the client. Your firm revokes access from one person and grants it to another internally. With direct permissions, every personnel change becomes forty emails asking clients to update their settings.

Two limits are worth knowing before you commit. Delegation works one level down only: your firm can grant permissions to its employees, but those employees cannot pass them further. An employee's scope also cannot exceed what the client granted the firm as a whole. If the client granted read access only, no employee will issue an invoice on their behalf, regardless of what your software allows.

Practical note: if your firm only receives and books documents, ask the client for invoice access alone. A narrower scope means less liability and a much shorter conversation during an audit.

KSeF certificates: one per client or one per firm

KSeF certificates are issued free of charge by the Ministry of Finance certification centre and serve as proof of identity strictly for communication with KSeF. There are two mutually exclusive types: the Authentication type is used to log in to the API, and the Offline type is used for QR code II (CERTYFIKAT) on invoices issued offline. Validity runs up to two years, and the number of certificates per NIP is capped. The process is documented in the user manual for the Certificate and Permission Module.

Under the Ministry's design, a single certificate can be used across different contexts, meaning on behalf of different entities, provided its holder has been granted permissions in each of them. It does not replace the permission grant. The certificate proves who you are; permissions decide what you may do.

In practice firms choose between two models. A firm-wide certificate covering every context is easier at the start, but KSeF then records your firm as the entity performing every operation. A certificate held per client gives a cleaner split of responsibility and an unambiguous audit trail inside each NIP context, at the cost of more certificates to track. Biurko follows the second model: every company has its own KSeF connection — via Profil Zaufany (the default), your own KSeF certificate or a certificate ordered through Biurko — with one connection flagged as primary. A session set up with Profil Zaufany does not renew itself, so for steady, automatic work order a KSeF certificate in Biurko — after the first connection with Profil Zaufany — and use it for the connection.

At twenty clients that means twenty expiry dates. This belongs in a system, not in someone's head. Biurko warns about an expiring certificate on screen 30 days ahead and sends notifications 7, 3 and 1 day before expiry and on the day itself, and it lets you export the certificates of all your companies as a single ZIP archive or disconnect selected connections in bulk.

Client onboarding: a procedure, not improvisation

A sequence you can repeat forty times:

1. Establish who holds owner permissions on the client side. Sole proprietorship: the owner, signing in with Profil Zaufany (the Polish government trusted profile). Company with a qualified seal: the seal. Company without one: ZAW-FA and a wait for the tax office.

2. Ask for permissions granted to the firm as an entity, with the right to sub-delegate, scoped to what the engagement letter actually covers.

3. Verify the grant from your side before declaring readiness. A permission that has been granted but never confirmed by the recipient logging in does not work.

4. Connect the company in your software — with Profil Zaufany to start, with a KSeF certificate in the long run.

5. Run a test send and a test import on a single invoice before the month starts.

6. Record the state in the client file: who holds permissions, in what scope, when the certificate expires, who owns the relationship.

Step six looks trivial and is the only one that decides, a year later, whether you can hand a client to another bookkeeper in half an hour.

Daily operation across many companies

Receiving purchase invoices is where manual work scales worst. A sane setup runs an automatic pull from KSeF configured per company, separately for sales and purchases, with a timestamp of the last successful run so the next pass does not drag the same range again. In Biurko automatic import is off by default; once switched on in the company settings it runs every 1, 3, 6, 12 or 24 hours (6 by default). Imported documents land in a review queue, and the bookkeeper marks them as reviewed only after reconciliation.

On the sending side, batch mode is what makes the difference: a package of invoices goes out in one session, with counters for accepted, rejected and retryable items. Rejections have to be read, and KSeF messages arrive as codes rather than sentences. Translating them into human language cuts error handling from a quarter of an hour to a minute.

Track the deadlines for exceptional modes separately. An invoice issued in offline24 mode must reach KSeF no later than the next business day (Article 106nda of the Polish VAT Act). In emergency mode, declared by the Ministry, the deadline is 7 business days counted from the end of the outage stated in the Ministry's notice (Article 106nf). Maintenance and outage notices are published in the KSeF technical announcements.

Dividing work inside the firm

Permissions in KSeF are one thing; permissions in your software are another. A bookkeeper running ten companies should not have access to subscription billing or to managing KSeF connections, because that is not their job.

An accountant joins a client's company as a free guest — one seat in every company, on every plan, including the free one — and switches between companies with one click. In Biurko each company carries its own set of roles: owner, administrator, accountant and member, plus custom roles with a configurable rank. The default Accountant role covers full invoicing (including changing an invoice number and the numbering templates), KSeF sending and importing, contractors, products, bank accounts, and the tax profile and declarations, but excludes managing the KSeF connection, the team, roles and company data. Nobody can grant permissions broader than their own, which closes the most common hole in hand-built permission models.

The calendar ahead

• 31 December 2026 — end of the deferral for taxpayers staying under PLN 10,000 gross per month in sales covered by the mandate. Crossing the threshold even once ends the deferral permanently and immediately.

• 1 January 2027 — under the current act, penalties under Article 106ni of the VAT Act begin. On 16 September 2026 the Ministry of Finance announced it will move them to 1 January 2028 (a bill not yet passed). The KSeF number also becomes mandatory in the title of bank transfers paying an invoice.

• 1 January 2027 — the smallest taxpayers come into scope.

Review your client portfolio against the PLN 10,000 threshold before the end of 2026. A client who crosses it in any month enters the full obligation right away, not in January.

Implementation checklist

• Split clients into three groups: sole proprietorship, company with a qualified seal, company requiring ZAW-FA.

• Default to indirect permissions granted to the firm as an entity, not to named individuals.

• Narrow the permission scope to what the engagement covers, and record it in the client file.

• Build a certificate register with expiry dates and switch on notifications.

• Configure automatic purchase invoice pulls separately for each company.

• Write down who responds to rejections and within what time.

• List clients approaching the PLN 10,000 threshold and contact them before they cross it.

Conclusion

Scaling KSeF inside an accounting firm is not about clicking faster. It is about one repeatable permission model, one certificate register, and one place from which you reach every client company.

Biurko handles this scenario as follows: one account and many companies you switch between in one click, a separate KSeF connection and separate roles in each company, automatic invoice import from KSeF (once switched on in the company settings), batch sending, and KSeF error messages translated into plain language. There is no separate office dashboard and no common screen with every client's invoices. TEAM at PLN 99 net per month gives five users and lets you run up to five companies, each company having its own plan. SCALE at PLN 199 net removes both limits. You can open an account at biurko.io in minutes: every new company gets 14 days of the TEAM plan without a card, then moves to the free FREE plan, and the accountant's seat is free on every plan.

FAQ

Can an accounting firm serve multiple clients in KSeF from one employee account? Yes, but the employee always works inside a specific client's NIP context rather than through a single pooled account. Permissions must be granted separately for each context, either directly by the client or indirectly by the firm.

What is the difference between direct and indirect permissions? Direct permissions are granted by the client to a named individual. Indirect permissions are granted to an entity, such as your firm, with the right to pass them to employees. Delegation works one level down only.

Do I need a separate KSeF certificate for every client? Under the Ministry's design one certificate can be used across multiple contexts, provided its holder has permissions there. Many firms still choose a certificate per client, because it produces a clearer audit trail and a simpler split of responsibility.

When does a client have to file ZAW-FA? When the client is not a natural person and cannot authenticate with a qualified electronic seal. The notification designates one individual with the broadest permissions, who then grants access to further people electronically.

How long is there to submit an invoice issued offline? In offline24 mode the deadline falls on the next business day after issuance (Article 106nda of the VAT Act). In an emergency mode declared by the Ministry it is 7 business days from the end of the outage stated in the Ministry's notice (Article 106nf).