How to Grant KSeF Permissions to Staff or an Accountant

ZAW-FA is not the same as granting permissions

These are two different things, and mixing them up is where most of the confusion starts.

ZAW-FA (Zawiadomienie o nadaniu lub odebraniu uprawnień — notification to the tax office about granting or removing KSeF access) is a paper or electronic filing. Its only job is to name one first natural person who can act on behalf of an entity when the system can't link a user to the company automatically. This is the standard situation for companies that don't hold a Polish qualified electronic seal.

Granting permissions happens inside KSeF itself — you do it online after logging in, for your staff, accountant, or accounting office. No tax office involved.

Inside KSeF you grant three core permission types:

There are also special permissions (e.g. self-invoicing and VAT RR farmer invoices). The permission types and the rules for granting them are set out in the Regulation of the Minister of Finance and Economy of 12 December 2025 on the use of KSeF (Journal of Laws / Dz.U. 2025, item 1815).

The sole-trader case (JDG): no ZAW-FA needed

A Polish sole trader — JDG (jednoosobowa działalność gospodarcza, sole proprietorship) — receives owner permissions automatically, tied to their tax ID (NIP). That's the full set: issuing, access, and permission management. It can't be revoked and isn't filed anywhere.

To start, they log in to KSeF with Profil Zaufany (Poland's free Trusted Profile e-ID), the mObywatel app, mojeID (online banking) or an e-ID card (since 14 February 2026 via login.gov.pl), or a qualified electronic signature containing a NIP or PESEL (the Polish personal ID number). After logging in, they grant access to whomever they need — electronically.

A natural person does not file ZAW-FA to assign an accountant or employee. The only exception: registering the "fingerprint" of a qualified signature that contains no NIP and no PESEL. That's a rare edge case.

This path mostly concerns Polish residents. For foreign owners, the company route below is the relevant one.

Foreign-owned company without a seal: ZAW-FA step by step

A spółka z o.o. (limited liability company), joint-stock company, or foundation is a non-natural-person entity. KSeF won't link it to a specific human automatically, so:

• Do you hold a qualified electronic seal (pieczęć kwalifikowana) with the company's NIP? Then you skip ZAW-FA — authenticate with the seal and grant further permissions online. You can also generate a KSeF certificate for automation.

• No seal? File ZAW-FA to designate one natural person (e.g. a board member or partner) who becomes the administrator.

Most foreign-owned companies do not hold a Polish qualified seal, so ZAW-FA is the usual entry point. The practical catch: the designated person must be able to authenticate to KSeF afterwards — which in practice means a qualified electronic signature, or a Profil Zaufany (which assumes a Polish personal identity / PESEL). Plan that ahead, especially for non-resident directors.

How to file ZAW-FA(3) — the version in force since 1 February 2026:

1. Complete the interactive form in the e-Urząd Skarbowy (e-Tax Office) portal, or download the template from the Ministry of Finance. You provide the company NIP, the competent tax office, the purpose (granting permissions) and the authorized person's details.

2. Enter the email addresses — they're mandatory both for the entity and for the authorized person. KSeF sends confirmation there; missing them triggers a request to complete the form.

3. Sign through the persons authorized to represent the company, in the number required for that entity (e.g. per its representation rules in the KRS court register).

4. Submit it: via the e-Urząd Skarbowy (as a general letter), via e-Doręczenia (registered e-delivery), or on paper. Note: since 1 January 2026, a ZAW-FA sent through ePUAP is no longer treated as effectively delivered.

5. Wait for it to be entered into the system. The office checks the form formally and registers it, usually within a few business days.

Under the current form, the designated person immediately receives permissions — including invoice issuing — and can then grant further access to others electronically, with no more office visits. The official rules are on the Ministry's "Permissions and authorization" page at ksef.podatki.gov.pl.

Granting permissions to an employee or accountant (electronically)

An employee, sales rep, or accountant gets no permissions automatically. You (the owner) or a designated administrator must grant them.

The flow is short:

1. Log in to KSeF (the Ministry's free Taxpayer Application — currently via the Certificates and Permissions module) or to commercial software integrated with KSeF over the API, including Biurko (Firma → Uprawnienia KSeF).

2. Open the Permissions section and choose to grant access.

3. Identify the natural person — by NIP or PESEL.

4. Pick the scope: invoice issuing, invoice access, or permission management. You don't have to grant everything — you can give issuing without viewing, or the reverse.

5. Save. The permission is tied to that specific person.

Example: a sales rep gets only "invoice issuing", while the accountant gets "invoice access" to pull cost invoices. Each person sees only what their job requires.

Keep in mind that invoice access exposes the company's invoice flow — both sales and purchases — not a hand-picked subset. Consider who genuinely needs the full view.

Accounting office: grant to the entity, not to its staff

If you work with an accounting office (biuro rachunkowe), you have two options:

• grant access to a specific natural person (e.g. the office owner) — by NIP/PESEL, or

• grant access to the whole office as an entity — by the office's NIP.

The second option is usually cleaner: the office assigns access to its own staff internally. You don't name them one by one and — importantly — you don't see their names. You only see that you authorized the office.

The key point: grant the office at least "invoice access." Without it, the office can't automatically pull your cost invoices from KSeF, and you're back to forwarding them by hand — losing one of the main benefits of e-invoicing.

For offices serving many clients: to pull or issue invoices for a given client, the office must authenticate in the context of that client's NIP separately. A KSeF certificate (valid up to two years, renewable) automates this in commercial applications. Under the current rules KSeF tokens expire on 31 December 2026. At consultations on 9 June 2026 the Ministry of Finance proposed keeping them, but no regulation has been adopted yet, so moving to a KSeF certificate is the safer choice.

Common mistakes when granting KSeF permissions

• Filing ZAW-FA as a sole trader. Unnecessary — you have owner permissions and grant access online.

• Sending ZAW-FA via ePUAP. Ineffective since 1 January 2026. Use the e-Urząd Skarbowy, e-Doręczenia, or paper.

• Leaving the email fields blank. They're mandatory; the office will ask you to complete the form.

• Naming two people on one ZAW-FA. Only one is allowed. Add the rest electronically.

• Assuming a new ZAW-FA revokes the previous person. It doesn't. Revoking is a separate step.

• Authorizing the office as a person instead of as an entity. If that person leaves the office, access disappears. Choose deliberately.

Checklist: before you grant KSeF access

• Confirm legal form: JDG → automatic permissions; company without a seal → ZAW-FA.

• Company: check whether you hold a qualified seal with NIP (if so, skip ZAW-FA).

• Make sure your ZAW-FA designee can authenticate later (qualified signature or Profil Zaufany).

• File ZAW-FA via e-Urząd Skarbowy or e-Doręczenia — not ePUAP.

• Name one person on ZAW-FA and fill in both email addresses.

• Give employees the minimum scope they need (issuing or access).

• Grant the accounting office at least "invoice access"; consider authorizing the entity, not a person.

• For multiple companies / automation, prepare a KSeF certificate.

In short

KSeF permissions only look intimidating until you separate two things: ZAW-FA (the first person for an entity without a seal) and day-to-day online granting (staff, accountant, office). A sole trader files no ZAW-FA. A company without a seal files it once, for one person.

Granting access is one thing; reliably issuing and receiving invoices on behalf of several companies is another. In Biurko you can grant and revoke KSeF permissions straight from the company (Firma → Uprawnienia KSeF), and each company has its own KSeF connection — via Profil Zaufany (the default), your own certificate or a certificate ordered through Biurko. An accountant joins a client's company as a free guest — one seat in every company, on every plan, including the free one — and switches between companies with one click, with plain-language messages instead of raw KSeF error codes. Create an account at biurko.io. Every new company gets 14 days of the TEAM plan without a card, then moves to the free FREE plan.

Related: KSeF Login in 2026: Trusted Profile, Signature or Certificate · KSeF is down — now what? offline24 mode, calmly explained

FAQ

Does a Polish sole trader need ZAW-FA to give an accountant access? No. A sole trader (JDG) has automatic owner permissions. They log in to KSeF with Profil Zaufany or a qualified signature and grant the accountant access electronically — no tax-office visit and no ZAW-FA form required.

How does a foreign-owned company get into KSeF? If the company has a Polish qualified electronic seal with its NIP, it authenticates with the seal — no ZAW-FA. Without a seal, it files ZAW-FA to name one natural person as administrator. That person then needs a qualified signature or Profil Zaufany to log in.

How many people can I list on one ZAW-FA? Only one natural person. They become the entity's administrator and can grant permissions to additional users electronically inside KSeF. To register a second person through the tax office you'd file a separate ZAW-FA, but that's usually unnecessary.

How do I grant KSeF permissions to an accounting office? After logging in, open the Permissions section, choose to grant access, identify the office by its NIP as an entity, and select the scope — at least "invoice access" so the office can pull your cost invoices. The office then assigns access to its own staff.

Can I send ZAW-FA via ePUAP? No. Since 1 January 2026, a ZAW-FA sent to a tax office via ePUAP is not treated as effectively delivered. Submit it through the e-Urząd Skarbowy, via e-Doręczenia, or on paper at your competent tax office.