Poland Consults on KSeF Token Extensions and Payment Permissions
Poland has opened a 14-day public consultation on proposed changes to its national e-invoicing system, KSeF, covering authentication tokens, certificates and permissions for handling payments across multiple invoices.
Published on 27 October, the draft regulation, reference 138/2026, would allow businesses to continue using authentication tokens beyond the end of 2026. It also sets out new validity limits and further rules for KSeF certificates. The proposals remain subject to consultation and adoption.
Under the draft, tokens generated from 1 January 2027 would be valid for a maximum of 365 days, measured from their creation or a starting date specified by the taxpayer. Tokens generated before that date would remain valid until 30 November 2027. This would give businesses using token-based connections more time to update their authentication arrangements.
The certificate proposals include arrangements for entities using Peppol and the option to generate a certificate restricted to a specified Polish tax identification number, or NIP, or a taxpayer’s branch identifier. Such restrictions could help service providers control access when handling invoices for several clients. The certificate would still depend on the permissions granted to its holder.
For finance and payments teams, the draft introduces a permission to manage collective payment identifiers, which link a payment to more than one invoice. It would cover generating, decoding, searching for and viewing these identifiers. The permission could also be granted separately, for example to a payments employee who does not issue invoices.
Most amendments are proposed to take effect on 1 January 2027. The provision extending the use of existing tokens would take effect a day earlier, on 31 December 2026, subject to completion of the legislative process.
