Your company or accounting firm needs to integrate its invoicing software with KSeF, and you're faced with the question: a qualified digital seal or ZAW-FA? This guide explains how authentication works in KSeF, why the seal (QSeal) is the best option for high-volume invoicing, and how to properly configure permissions, including those for the client being served.
The requirement to use KSeF is being phased in and applies to VAT taxpayers—both those subject to VAT and those exempt from VAT:
Important to note: throughout the year 2026 There are no fines for mistakes In KSeF—this is a transition period for gradual adaptation. However, this does not mean that you can delay integration: the obligation to issue invoices in KSeF already exists, and starting January 1, 2027, an invoice issued outside the system may result in a penalty of up to 100% of the VAT amount on that invoice.
KSeF communicates with external programs via API (Application Programming Interface). Every API call requires authentication—that is, confirmation of the identity of the entity sending the invoices. Authentication always takes place for part number NIP the company to which the invoice pertains.
In practice, the system—such as your invoicing software or ERP—must have one of the following tools:
For an ERP system that sends invoices automatically (e.g., at night or on weekends), the only way to achieve complete independence from any specific person is qualified seal — The other paths require the involvement of a designated person, at least when obtaining and renewing access.
Both methods are legal, but in practice they work very differently. We've summarized the key differences in the table below:
| Criterion | Qualified Electronic Seal (QSeal) | ZAW-FA (Designation of an Individual) |
|---|---|---|
| Assignment | For the NIP from | To a specific individual |
| Automation | Full — the system operates without human intervention | Limited — requires the person's active participation |
| Staff Rotation | No impact — the seal remains valid regardless of personnel changes | The ZAW-FA update is required whenever there is a change in personnel |
| Invoice Volume | Unlimited (ideal for high volumes) | It could be a bottleneck during mass issuance |
| Accounting Firm | A single seal can be used by multiple clients (after permissions are granted) | Each client requires a separate setup with a person |
| Security | High-level isolation — keys stored in an HSM module or card | Accounts Dependent on the Security of an Individual's Account |
| Implementation Costs | Starting at 1,289 PLN (SimplySign) or starting at 1,399 PLN (Certum Mini) | No cost for the certificate, but there is an administrative fee |
You can read more about this decision in the guide: ZAW-FA or e-Seal — Permission Management in KSeF for Companies.
Accounting Firm It is a special case: it operates on behalf of dozens of clients, each of whom has their own NIP. Configuring ZAW-FA for each client individually would require dozens of notifications to the tax authorities—and just as many updates whenever there are personnel changes.
A qualified seal solves this problem differently: the office receives from the client authorization to operate under KSeF (so-called "subject-based authorization"), and then uses its KSeF seal or certificate to send invoices via the API. The entire process is transparent, auditable, and—importantly— It does not get stuck when an employee is laid off or replaced.
For companies that handle a large volume of invoices (several hundred per month), the benefits are just as clear:
You can read more about the role of qualified digital signatures in KSeF automation in the article: Qualified Seal QSeal — KSeF, automation, authorization control.
The KSeF system features a comprehensive permissions model. The owner of NIP (the taxpayer) can grant access to other entities or individuals, defining the scope of their actions for each one:
The client logs in to their KSeF account (e.g., using a qualified digital signature or a trusted profile) and, in the permissions panel, designates the accounting firm’s NIP account and the scope of permissions. The accounting firm can then act on behalf of the client—issuing or collecting invoices—using its own credentials.
Important rule: Authorizations in KSeF have a specific scope and may be revoked at any time. For transparency, it is recommended that the office maintain a record of each client’s authorizations.
| The role of | What it can do | Who should have |
|---|---|---|
| Owner of NIP / Authorized Entity | Everything, including granting and revoking permissions | Company owner, CEO/management |
| Invoice Issuer | Issuing and Sending to KSeF, Retrieving a Copy | Accounting staff, the company's ERP system, accounting firm |
| Invoice Reader | Downloading Invoices (No Shipping) | Auditor, Financial Controller |
| Permissions Manager | Granting/Revoking Access to Others | System Administrator, Chief Financial Officer |
KSeF provides for offline mode 24—you can use it at any time, on your own initiative (e.g., when there is no internet connection), not just during a system failure. Rules:
Offline mode is not a substitute for everyday use—it’s a backup procedure. Your invoicing software or ERP system should support this mode technically. For details, see the guide: KSeF offline — two QR codes and a KSeF Type 2 Certificate.
The implementation of a qualified digital seal for integration with KSeF consists of several steps:
KSeF represents an irreversible change in the way invoices are issued—and choosing the right authentication method determines whether the integration will be smooth and automated or whether it will cause problems with every personnel change.
As authorized partner Certum We help companies and accounting firms implement a qualified digital seal ready for integration with KSeF—from ordering the certificate, through configuration, to training on access rights management.
📞 Call us: +48 22 417 05 55 — We’ll provide advice by phone, online, or at our offices in Warsaw, Kraków, Wrocław, and Radom.
🛒 Check out the offer:
For more technical information, visit the official KSeF website: ksef.podatki.gov.pl.
The invoicing software or ERP system communicates with KSeF via the Ministry of Finance’s API. For the system to send invoices automatically, it must be authenticated with the company’s NIP—most conveniently using a qualified digital seal (QSeal), which allows for operation without human intervention. Alternatively, the process can be handled by a person designated via a ZAW-FA notification (who logs in using a qualified digital signature or a trusted profile) or a free KSeF certificate — however, these options require the involvement of a specific person when gaining access and for periodic certificate renewal (at most every 2 years).
A qualified signature is assigned to a natural person—it is used to sign documents manually. A qualified seal (QSeal) is assigned to a legal entity (NIP) and is used for the automatic authentication of an IT system. In KSeF, the seal enables the bulk, automated sending of invoices without requiring an employee to be involved in each transaction.
Yes, but only after the client has formally granted permissions in the KSeF dashboard. The client logs in to their KSeF account and designates the accounting firm’s NIP account, along with the scope of permissions (e.g., issuing invoices). The firm can then act on behalf of the client using its own authentication credentials—such as a qualified seal or a KSeF certificate.
Offline24 mode allows a taxpayer to issue an invoice outside the system on their own initiative; separate emergency modes are available in the event of a KSeF system failure. The invoice is generated locally in XML format, and when sent to the buyer outside of KSeF, it must include two QR codes. You must upload it to KSeF no later than the next business day after issuance (up to 7 business days following an announced outage). The second QR code requires a KSeF Type 2 certificate.
Large companies whose sales (including VAT) exceeded 200 million PLN in 2024 — effective February 1, 2026. Other companies, including VAT-exempt taxpayers (micro, small, and medium-sized) — effective April 1, 2026. The smallest „digitally excluded” taxpayers with gross monthly sales of ≤ 10,000 PLN — effective January 1, 2027.
Both seals are qualified trust services issued by Certum and are legally equivalent. SimplySign is a cloud-based solution—a certificate accessible via API without a physical card, ideal for automated server integrations. Certum Mini is a cryptographic card with a reader—it works well where local physical control of the private key is required. For integration with KSeF via API, SimplySign is usually more convenient.
