A firm with forty clients does not have one KSeF implementation after the mandate. It has forty separate permission configurations, forty NIP (Polish tax identification number) contexts, and forty document streams that keep flowing whether or not anyone looked at them today.
Since 1 April 2026 the obligation to issue structured invoices has covered the remaining VAT payers, following the first wave on 1 February 2026 for the largest taxpayers. That part is behind us. Two dates ahead will change how firms work: 31 December 2026 ends the deferral for the smallest taxpayers who stay under the PLN 10,000 monthly threshold, and 1 January 2027 activates administrative penalties along with the requirement to quote the KSeF number in bank transfer titles.
What follows is the practical layout: how to build an access model that scales to dozens of clients, and what a working day looks like when invoices arrive from many companies at once.
Three layers of access that get confused for one
The most common mistake in firm-side rollouts is treating "KSeF access" as a single thing. It is three independent layers:
Formal. Who on the client side can grant permissions at all. A JDG (Polish sole proprietorship) owner receives full owner permissions automatically upon authentication. A company without a qualified electronic seal must first file the ZAW-FA notification (version 3 applies from 1 February 2026), which designates the first individual holding the broadest permissions.
Permissions. What scope the client granted your firm inside KSeF: issuing invoices, accessing invoices, managing permissions.
Technical. What your accounting software authenticates with: a KSeF certificate.
A mismatch between these layers is the usual reason a first send returns a 403. The client "signed everything", but nobody logged into the taxpayer application and actually granted the permission.
Indirect permissions: the model that scales
In the standard model a taxpayer grants two kinds of permissions: direct ones, to a named individual identified by NIP or PESEL (the Polish personal identification number), and indirect ones, to an entity such as an accounting firm, with the right to pass permissions further down. The rules come from the Regulation of the Minister of Finance and Economy of 12 December 2025 on the use of the National e-Invoicing System, and the Ministry publishes practical guidance in its KSeF 2.0 questions and answers.
The difference is operational, not cosmetic:
Model What the client does What the firm does When to use Direct permissions Names every bookkeeper individually (NIP/PESEL) Nothing, access is ready 1 to 3 clients, one fixed contact Indirect permissions Names the firm by NIP and ticks the right to sub-delegate Distributes access to its own staff From roughly a dozen clients upward
With indirect permissions, staff turnover no longer requires contacting the client. Your firm revokes access from one person and grants it to another internally. With direct permissions, every personnel change becomes forty emails asking clients to update their settings.
Two limits are worth knowing before you commit. Delegation works one level down only: your firm can grant permissions to its employees, but those employees cannot pass them further. An employee's scope also cannot exceed what the client granted the firm as a whole. If the client granted read access only, no employee will issue an invoice on their behalf, regardless of what your software allows.
Practical note: if your firm only receives and books documents, ask the client for invoice access alone. A narrower scope means less liability and a much shorter conversation during an audit.
KSeF certificates: one per client or one per firm
KSeF certificates are issued free of charge by the Ministry of Finance certification centre and serve as proof of identity strictly for communication with KSeF. There are two types: type 1 for API authentication and type 2, required for offline modes and for generating QR codes. Validity runs up to two years, and the number of certificates per NIP is capped. The process is documented in the user manual for the Certificate and Permission Module.
Under the Ministry's design, a single certificate can be used across different contexts, meaning on behalf of different entities, provided its holder has been granted permissions in each of them. It does not replace the permission grant. The certificate proves who you are; permissions decide what you may do.
In practice firms choose between two models. A firm-wide certificate covering every context is easier at the start, but KSeF then records your firm as the entity performing every operation. A certificate held per client gives a cleaner split of responsibility and an unambiguous audit trail inside each NIP context, at the cost of more certificates to track. Biurko follows the second model: every company in the panel has its own KSeF connection based on a certificate issued for that company's NIP, with one connection flagged as primary.
At twenty clients that means twenty expiry dates. This belongs in a system, not in someone's head. Biurko monitors certificate validity and sends advance notifications, and it lets you export the certificates of all your companies as a single ZIP archive or disconnect selected connections in bulk.
Client onboarding: a procedure, not improvisation
A sequence you can repeat forty times:
Establish who holds owner permissions on the client side. Sole proprietorship: the owner, signing in with Profil Zaufany (the Polish government trusted profile). Company with a qualified seal: the seal. Company without one: ZAW-FA and a wait for the tax office.
Ask for permissions granted to the firm as an entity, with the right to sub-delegate, scoped to what the engagement letter actually covers.
Verify the grant from your side before declaring readiness. A permission that has been granted but never confirmed by the recipient logging in does not work.
Generate the certificate and connect the company in your software.
Run a test send and a test import on a single invoice before the month starts.
Record the state in the client file: who holds permissions, in what scope, when the certificate expires, who owns the relationship.
Step six looks trivial and is the only one that decides, a year later, whether you can hand a client to another bookkeeper in half an hour.
Daily operation across many companies
Receiving purchase invoices is where manual work scales worst. A sane setup runs an automatic pull from KSeF configured per company, separately for sales and purchases, with a timestamp of the last successful run so the next pass does not drag the same range again. Imported documents land in a review queue, and the bookkeeper marks them as reviewed only after reconciliation.
On the sending side, batch mode is what makes the difference: a package of invoices goes out in one session, with counters for accepted, rejected and retryable items. Rejections have to be read, and KSeF messages arrive as codes rather than sentences. Translating them into human language cuts error handling from a quarter of an hour to a minute.
Track the deadlines for exceptional modes separately. An invoice issued in offline24 mode must reach KSeF no later than the next business day (Article 106nda of the Polish VAT Act). In emergency mode, declared by the Ministry, the deadline is 7 business days counted from the end of the outage (Article 106nf). Maintenance and outage notices are published in the KSeF technical announcements.
Dividing work inside the firm
Permissions in KSeF are one thing; permissions in your software are another. A bookkeeper running ten companies should not have access to subscription billing or to managing KSeF connections, because that is not their job.
In Biurko each company carries its own set of roles: owner, administrator, accountant and observer, plus custom roles with a configurable rank. The accountant preset covers full invoicing, KSeF sending and importing, but excludes connection management, team management, roles and settings. Nobody can grant permissions broader than their own, which closes the most common hole in hand-built permission models.
The calendar ahead
31 December 2026 — end of the deferral for taxpayers staying under PLN 10,000 gross per month in sales covered by the mandate. Crossing the threshold even once ends the deferral permanently and immediately.
1 January 2027 — administrative penalties for KSeF breaches begin, and the KSeF number becomes mandatory in the title of bank transfers paying an invoice.
1 January 2027 — the smallest taxpayers come into scope.
Review your client portfolio against the PLN 10,000 threshold this quarter. A client who crosses it in September enters the full obligation right away, not in January.
Implementation checklist
Split clients into three groups: sole proprietorship, company with a qualified seal, company requiring ZAW-FA.
Default to indirect permissions granted to the firm as an entity, not to named individuals.
Narrow the permission scope to what the engagement covers, and record it in the client file.
Build a certificate register with expiry dates and switch on notifications.
Configure automatic purchase invoice pulls separately for each company.
Write down who responds to rejections and within what time.
List clients approaching the PLN 10,000 threshold and contact them before they cross it.
Conclusion
Scaling KSeF inside an accounting firm is not about clicking faster. It is about one repeatable permission model, one certificate register, and one place where every client company is visible.
Biurko is built around exactly this scenario: many companies in one panel, a separate KSeF connection and separate roles for each, automatic purchase invoice import, batch sending, and KSeF error messages translated into plain language. The TEAM plan covers 5 companies and 5 users at PLN 49 net per month; the SCALE plan removes the company and user limits at PLN 149 net. You can open a free account at biurko.io in minutes, with no card and no trial period, and connect your first client today.
FAQ
Can an accounting firm serve multiple clients in KSeF from one employee account? Yes, but the employee always works inside a specific client's NIP context rather than through a single pooled account. Permissions must be granted separately for each context, either directly by the client or indirectly by the firm.
What is the difference between direct and indirect permissions? Direct permissions are granted by the client to a named individual. Indirect permissions are granted to an entity, such as your firm, with the right to pass them to employees. Delegation works one level down only.
Do I need a separate KSeF certificate for every client? Under the Ministry's design one certificate can be used across multiple contexts, provided its holder has permissions there. Many firms still choose a certificate per client, because it produces a clearer audit trail and a simpler split of responsibility.
When does a client have to file ZAW-FA? When the client is not a natural person and cannot authenticate with a qualified electronic seal. The notification designates one individual with the broadest permissions, who then grants access to further people electronically.
How long is there to submit an invoice issued offline? In offline24 mode the deadline falls on the next business day after issuance (Article 106nda of the VAT Act). In an emergency mode declared by the Ministry it is 7 business days from the end of the outage (Article 106nf).
<!-- Internal links to replace before publishing: - /blog/ksef-permissions-how-to-grant - /blog/ksef-certificate-vs-token - /blog/ksef-10000-pln-threshold - /blog/ksef-offline24-and-emergency-mode -->