KSeF in outsourced invoice workflows: 10 controls that protect the process
KSeF structures invoice exchange, but it does not replace business approval, access control or responsibility for payment. Here is how to divide the process safely between the company and its provider.
Since 1 February 2026, KSeF 2.0 has been the mandatory system for receiving invoices in Poland, and since 1 April it has covered the issue of invoices by most businesses. The smallest companies, whose monthly sales documented by invoices do not exceed PLN 10,000 gross, join on 1 January 2027. KSeF has therefore become a permanent part of finance and accounting operations, including processes delivered by an external provider.
The Ministry of Finance system issues, transmits, makes available and stores structured invoices. It does not perform business approval, cost allocation, purchase-order matching or payment decisions for the company. Consequently, outsourcing Accounts Payable processes requires an end-to-end workflow, not merely an API connection.
1. Map the process from invoice retrieval to payment
Document every step: retrieving the invoice from KSeF, registration, formal validation, vendor identification, company and cost-centre allocation, matching against an order or contract, business approval, posting, payment, correction and reporting. Assign a system, owner, deadline and evidence to each step. Only this map shows what can safely be handed to the provider.
2. Separate technical access from taxpayer accountability
A company may authorise employees and cooperating entities to issue or view invoices. Granting access does not transfer accountability for tax correctness, approval policy or payment control. The agreement should identify who retrieves documents, resolves exceptions, approves posting and is allowed to initiate a payment.
3. Apply least privilege
The provider should receive only the access needed for the agreed scope. A person retrieving invoices does not necessarily need to manage permissions, and a data-entry operator should not approve payments. Separate operational, control and administrative roles. Maintain a register showing who received access, when, from whom, for what scope, when it was last used and when it must be revoked.
4. Do not build the workflow around a shared token
Shared credentials make it difficult to identify who performed an action and to remove one person without disrupting the whole team. Use individual roles or controlled technical credentials assigned to an integration. Treat a certificate or token as a secret: store it securely, restrict export, name an owner, set validity and rotation rules, and define revocation when cooperation ends.
5. Control completeness and duplicates
An invoice available in KSeF can still be assigned to the wrong entity, imported twice into the ERP or combined with a copy sent by email. The control should compare at least the KSeF number, seller tax ID, invoice number, date, amount and currency. An exception register should display missing documents, rejected imports and invoices awaiting clarification.
6. Do not confuse presence in KSeF with business approval
A KSeF number confirms acceptance by the platform. It does not confirm that goods or services were delivered, the price matches the contract, the buyer accepts the cost or the invoice should be paid. For purchase-order spend, match the invoice, purchase order and proof of delivery. For other spend, define the cost owner, approval thresholds and substitutes.
7. Design an exception and correction queue
The standard path remains simple only until the first exception. Define in advance how to handle an unknown vendor, wrong tax ID, amount variance, missing purchase order, correction, duplicate, disputed invoice, document outside KSeF and invoice received under a special mode. Every exception needs an owner, deadline and escalation path. Otherwise outsourcing speeds up registration but slows down resolution.
8. Establish offline24 and outage procedures
Under offline24, an invoice should reach KSeF no later than the next business day. During an outage officially announced by the Ministry of Finance, the general deadline is seven business days after the outage ends. A type 2 KSeF certificate is used to mark invoices issued under special modes. The provider must know who monitors announcements, activates the contingency process, holds the document queue and confirms completeness after service is restored.
9. Require an audit trail
The report should connect the source, KSeF number, retrieval time, validation result, data changes, approvers, exception decisions, ERP export and payment status. Audit evidence must show not only that a task was completed, but who did it, when and on what basis. This can be linked with an operational document and status register.
10. Put outcomes, security and exit into the SLA
| Area | Metric | Evidence |
|---|---|---|
| Completeness | Share of invoices retrieved and registered correctly | KSeF-to-ERP reconciliation |
| Timeliness | Time from availability to registration and approval | Timestamps |
| Quality | Misallocations and corrections | Exception register |
| Access | Time to revoke rights after a role change | Permission history |
| Outage | Time to switch to contingency processing | Test and incident report |
| Exit | Completeness of data and log export | Handover protocol |
The exit plan should cover revoking permissions, invalidating credentials, handing over open items, exporting history, reconciling the document queue and confirming deletion by the provider. It should align with the business continuity plan.
Practical pre-launch checklist
- Define the scope for issuing, receiving and processing invoices.
- Set a RACI for each stage and exception.
- Grant minimal, named permissions.
- Separate registration, approval and payment.
- Test duplicates, corrections and missing purchase orders.
- Run an offline24 and outage drill.
- Agree a KSeF-to-ERP completeness report.
- Define retention of logs and evidence.
- Include quality, deadlines and security in the SLA.
- Test access revocation and the exit plan.
Sources
- Polish Ministry of Finance: KSeF 2.0 rollout
- Polish Ministry of Finance: permissions and process preparation
- Polish Ministry of Finance: KSeF certificates
- Polish Ministry of Finance: offline24 mode
- Polish Ministry of Finance: outage mode
FAQ
Can an external provider retrieve invoices from KSeF?
Yes, if it receives the relevant permission. Access must match the task, while the company retains control over accountability, approvals and security.
Does KSeF replace Accounts Payable?
No. KSeF exchanges and stores structured invoices, but it does not replace purchase validation, cost approval, order matching, posting or payment.
Can one token be used by the whole team?
An integration may use a technical credential, but uncontrolled shared tokens weaken auditability and revocation. Named roles or a managed technical credential with limited scope and rotation are safer.
What should the provider do during a KSeF outage?
Activate the agreed contingency procedure, monitor official announcements, mark documents correctly, maintain a queue and submit invoices within the deadline applicable to the relevant mode.
How can completeness be verified?
Reconcile invoices available in KSeF with the provider register and ERP, investigate differences and preserve evidence of retrieval, validation, approval and export.