ZAW-FA is not the same as granting permissions
These are two different things, and mixing them up is where most of the confusion starts.
ZAW-FA (Zawiadomienie o nadaniu lub odebraniu uprawnień — notification to the tax office about granting or removing KSeF access) is a paper or electronic filing. Its only job is to name one first natural person who can act on behalf of an entity when the system can't link a user to the company automatically. This is the standard situation for companies that don't hold a Polish qualified electronic seal.
Granting permissions happens inside KSeF itself — you do it online after logging in, for your staff, accountant, or accounting office. No tax office involved.
Inside KSeF you grant three core permission types:
Permission What it allows Permission management Granting and revoking access for others (the broadest scope — administrator role) Invoice issuing Creating and sending structured invoices to KSeF Invoice access Viewing and receiving the company's sales and purchase invoices
There are also special permissions (e.g. self-invoicing and VAT RR farmer invoices). The permission types and the rules for granting them are set out in the Regulation of the Minister of Finance and Economy of 12 December 2025 on the use of KSeF (Journal of Laws / Dz.U. 2025, item 1815).
The sole-trader case (JDG): no ZAW-FA needed
A Polish sole trader — JDG (jednoosobowa działalność gospodarcza, sole proprietorship) — receives owner permissions automatically, tied to their tax ID (NIP). That's the full set: issuing, access, and permission management. It can't be revoked and isn't filed anywhere.
To start, they log in to KSeF with Profil Zaufany (Poland's free Trusted Profile e-ID), the mObywatel app, or a qualified electronic signature containing a NIP or PESEL (the Polish personal ID number). After logging in, they grant access to whomever they need — electronically.
A natural person does not file ZAW-FA to assign an accountant or employee. The only exception: registering the "fingerprint" of a qualified signature that contains no NIP and no PESEL. That's a rare edge case.
This path mostly concerns Polish residents. For foreign owners, the company route below is the relevant one.
Foreign-owned company without a seal: ZAW-FA step by step
A spółka z o.o. (limited liability company), joint-stock company, or foundation is a non-natural-person entity. KSeF won't link it to a specific human automatically, so:
Do you hold a qualified electronic seal (pieczęć kwalifikowana) with the company's NIP? Then you skip ZAW-FA — authenticate with the seal and grant further permissions online. You can also generate a token or KSeF certificate for automation.
No seal? File ZAW-FA to designate one natural person (e.g. a board member or partner) who becomes the administrator.
Most foreign-owned companies do not hold a Polish qualified seal, so ZAW-FA is the usual entry point. The practical catch: the designated person must be able to authenticate to KSeF afterwards — which in practice means a qualified electronic signature, or a Profil Zaufany (which assumes a Polish personal identity / PESEL). Plan that ahead, especially for non-resident directors.
How to file ZAW-FA(3) — the version in force since 1 February 2026:
Complete the interactive form in the e-Urząd Skarbowy (e-Tax Office) portal, or download the template from the Ministry of Finance. You provide the company NIP, the competent tax office, the purpose (granting permissions) and the authorized person's details.
Enter the email addresses — they're mandatory both for the entity and for the authorized person. KSeF sends confirmation there; missing them triggers a request to complete the form.
Sign through the persons authorized to represent the company, in the number required for that entity (e.g. per its representation rules in the KRS court register).
Submit it: via the e-Urząd Skarbowy (as a general letter), via e-Doręczenia (registered e-delivery), or on paper. Note: since 1 January 2026, a ZAW-FA sent through ePUAP is no longer treated as effectively delivered.
Wait for it to be entered into the system. The office checks the form formally and registers it, usually within a few business days.
Under the current form, the designated person immediately receives permissions — including invoice issuing — and can then grant further access to others electronically, with no more office visits. The official rules are on the Ministry's "Permissions and authorization" page at ksef.podatki.gov.pl.
Granting permissions to an employee or accountant (electronically)
An employee, sales rep, or accountant gets no permissions automatically. You (the owner) or a designated administrator must grant them.
The flow is short:
Log in to KSeF (the Ministry's free Taxpayer Application — currently via the Certificates and Permissions module) or to commercial software integrated with KSeF over the API.
Open the Permissions section and choose to grant access.
Identify the natural person — by NIP or PESEL.
Pick the scope: invoice issuing, invoice access, or permission management. You don't have to grant everything — you can give issuing without viewing, or the reverse.
Save. The permission is tied to that specific person.
Example (illustrative — replace with real data if available): a sales rep gets only "invoice issuing", while the accountant gets "invoice access" to pull cost invoices. Each person sees only what their job requires.
Keep in mind that invoice access exposes the company's invoice flow — both sales and purchases — not a hand-picked subset. Consider who genuinely needs the full view.
Accounting office: grant to the entity, not to its staff
If you work with an accounting office (biuro rachunkowe), you have two options:
grant access to a specific natural person (e.g. the office owner) — by NIP/PESEL, or
grant access to the whole office as an entity — by the office's NIP.
The second option is usually cleaner: the office assigns access to its own staff internally. You don't name them one by one and — importantly — you don't see their names. You only see that you authorized the office.
The key point: grant the office at least "invoice access." Without it, the office can't automatically pull your cost invoices from KSeF, and you're back to forwarding them by hand — losing one of the main benefits of e-invoicing.
For offices serving many clients: to pull or issue invoices for a given client, the office must authenticate in the context of that client's NIP separately. A KSeF certificate (valid up to two years, renewable) or a token automates this in commercial applications.
Common mistakes when granting KSeF permissions
Filing ZAW-FA as a sole trader. Unnecessary — you have owner permissions and grant access online.
Sending ZAW-FA via ePUAP. Ineffective since 1 January 2026. Use the e-Urząd Skarbowy, e-Doręczenia, or paper.
Leaving the email fields blank. They're mandatory; the office will ask you to complete the form.
Naming two people on one ZAW-FA. Only one is allowed. Add the rest electronically.
Assuming a new ZAW-FA revokes the previous person. It doesn't. Revoking is a separate step.
Authorizing the office as a person instead of as an entity. If that person leaves the office, access disappears. Choose deliberately.
Checklist: before you grant KSeF access
Confirm legal form: JDG → automatic permissions; company without a seal → ZAW-FA.
Company: check whether you hold a qualified seal with NIP (if so, skip ZAW-FA).
Make sure your ZAW-FA designee can authenticate later (qualified signature or Profil Zaufany).
File ZAW-FA via e-Urząd Skarbowy or e-Doręczenia — not ePUAP.
Name one person on ZAW-FA and fill in both email addresses.
Give employees the minimum scope they need (issuing or access).
Grant the accounting office at least "invoice access"; consider authorizing the entity, not a person.
For multiple companies / automation, prepare a KSeF certificate.
In short
KSeF permissions only look intimidating until you separate two things: ZAW-FA (the first person for an entity without a seal) and day-to-day online granting (staff, accountant, office). A sole trader files no ZAW-FA. A company without a seal files it once, for one person.
Granting access is one thing; reliably issuing and receiving invoices on behalf of several companies is another. Biurko connects to KSeF with a certificate per company — so you don't log in to each one by hand — and lets you manage your team and every client entity from a single panel, with plain-language messages instead of raw KSeF error codes. Create an account and try Biurko free for 14 days at biurko.io.
Related: KSeF authentication — certificate step by step · Offline24 mode in practice (internal links — replace slugs with final URLs before publishing).
FAQ
Does a Polish sole trader need ZAW-FA to give an accountant access? No. A sole trader (JDG) has automatic owner permissions. They log in to KSeF with Profil Zaufany or a qualified signature and grant the accountant access electronically — no tax-office visit and no ZAW-FA form required.
How does a foreign-owned company get into KSeF? If the company has a Polish qualified electronic seal with its NIP, it authenticates with the seal — no ZAW-FA. Without a seal, it files ZAW-FA to name one natural person as administrator. That person then needs a qualified signature or Profil Zaufany to log in.
How many people can I list on one ZAW-FA? Only one natural person. They become the entity's administrator and can grant permissions to additional users electronically inside KSeF. To register a second person through the tax office you'd file a separate ZAW-FA, but that's usually unnecessary.
How do I grant KSeF permissions to an accounting office? After logging in, open the Permissions section, choose to grant access, identify the office by its NIP as an entity, and select the scope — at least "invoice access" so the office can pull your cost invoices. The office then assigns access to its own staff.
Can I send ZAW-FA via ePUAP? No. Since 1 January 2026, a ZAW-FA sent to a tax office via ePUAP is not treated as effectively delivered. Submit it through the e-Urząd Skarbowy, via e-Doręczenia, or on paper at your competent tax office.