KSeF invoices are flowing in. Here’s the Power Automate approval flow your finance team is missing

1. The real problem: KSeF is mandatory, approvals are not

From 1 April 2026 KSeF is planned to be mandatory for most companies, and the no‑penalty period is currently announced to end on 31 December 2026. That means from January 2027 your invoices must be in KSeF under the current schedule, but nothing in KSeF itself solves:

• Who approves which invoice
• How exceptions are escalated
• How you track approval status vs. posting in your ERP

Typical symptoms in teams right now:

• KSeF XMLs are stored in a folder; finance exports PDFs and sends them by email for approval.
• Approvers reply with “OK” or “reject” in Outlook; someone in accounting updates a manual tracker.
• Nobody has a clean audit trail that links KSeF invoice ID → approver → final status → posting document.

On top of that:

• There is no native KSeF connector in Power Automate.
• KSeF requires a .p12 certificate, XAdES signing and encrypted sessions, which isn’t supported directly in standard cloud flows.

So the realistic architecture is:

1. External integration layer (custom app, middleware, ERP add‑on) handles KSeF connectivity, signing and download of XML.
2. That layer drops XML + metadata into a storage location Power Automate can read (SharePoint, OneDrive, Azure Blob, Dataverse).
3. Power Automate handles approval, routing, status and integration with the tools your users already live in (Teams, Outlook, SharePoint).

The rest of the article assumes you already have step 1 in place: something is reliably saving KSeF XMLs and basic metadata to SharePoint or a similar store.

2. Target architecture: one flow, three layers

We’ll build a single core approval flow with three logical layers:

1. Intake layer – triggered when a new KSeF invoice file appears.
2. Approval layer – handles assignment, reminders, escalations and decisions.
3. Output layer – writes the final status back to a structured store and notifies downstream systems or people.

2.1. Data model: what you need per invoice

You need a stable place to track invoice metadata and approval state. A SharePoint list works well for most teams; Dataverse is better if you’re already on premium licenses and want deeper integration.

Minimal fields for a SharePoint list KSeF Invoices:

• Title – human‑friendly label, e.g. FV 2026/10/123 – Vendor X
• KSeFInvoiceId – the KSeF system ID (from your integration layer)
• VendorName – parsed from XML or provided by integration
• InvoiceNumber – vendor’s invoice number
• InvoiceDate – invoice issue date
• TotalGross – total amount
• Currency – ISO code
• CostCenter – used to route to the correct approver
• Approver – Person/Group field
• ApprovalStatus – Choice (New, Pending, Approved, Rejected, On Hold)
• ApprovalComments – Multiple lines of text
• InvoiceFileUrl – link to the stored XML/PDF
• CreatedByIntegration – Yes/No, to distinguish manual entries

Your integration layer should populate as many of these columns as possible when it drops a new invoice.

3. Intake: trigger the flow when KSeF XML arrives

Assume KSeF XMLs are saved into a SharePoint document library KSeF-Invoices with a folder structure like /Incoming/Year/Month. The intake part of the flow does three things:

1. Detect a new file.
2. Parse basic metadata (if not already provided in properties).
3. Create or update the corresponding row in KSeF Invoices list.

3.1. Recommended trigger configuration

Use a cloud flow with the SharePoint trigger:

• Trigger: When a file is created (properties only)
• Site Address: your KSeF invoices site
• Library Name: KSeF-Invoices

This trigger fires when a file’s properties are created, without loading full content, which is efficient for high volume.

If your integration layer writes metadata into custom columns on the file (e.g. KSeFInvoiceId, VendorName), you can skip XML parsing in Power Automate and simply map those columns into the list.

3.2. Creating the tracking record

Core steps in the intake branch:

1. Initialize variables

   • For any metadata that may come from XML or file properties.

2. Get file properties (SharePoint – Get file properties)

   • Retrieve custom columns populated by your integration.

3. Create item in KSeF Invoices list (SharePoint – Create item)

   • Map file properties to list columns.

4. Set ApprovalStatus = "Pending" and Approver based on routing rules.

Routing can come from a separate list Cost Centers with columns:

• CostCenter
• Approver (Person/Group)

Use Get items with a filter query. In the Filter Query box, use an OData expression like:

CostCenter eq '@{triggerOutputs()?['body']['CostCenter']}'

Then set the Approver field on the invoice item from the returned record.

4. Approval: the flow your finance team is missing

Once the intake creates a list item with ApprovalStatus = Pending and Approver set, you can trigger the approval flow off that list.

4.1. Trigger from the tracking list

Create a second cloud flow:

• Trigger: When an item is created (SharePoint)
• Site Address: same site
• List Name: KSeF Invoices

Add a Condition immediately:

• If ApprovalStatus equals Pending
• And CreatedByIntegration equals Yes

Only then continue with the approval logic. This avoids loops if someone edits the item manually.

4.2. Use the built‑in Approvals connector

The Approvals connector in Power Automate (Power Automate approvals) is well suited here. For a single approver per invoice:

1. Action: Create an approval (v2)

   • Approval type: Approve/Reject – First to respond
   • Title: e.g. KSeF Invoice @{triggerOutputs()?['body']['KSeFInvoiceId']}
   • Assigned to: Approver Email from the list item
   • Details: include key metadata and a link to the invoice file

2. Action: Wait for an approval (v2)

   • Use the Approval ID from the previous action.

3. After the approval result is available, update the list item:

   • If outcome is Approve:
     • Set ApprovalStatus = "Approved"
     • Append comments: from Responses Comments.
   • If outcome is Reject:
     • Set ApprovalStatus = "Rejected"
     • Append comments.

This creates a consistent audit trail:

• Approvals are stored in the Approvals system.
• The list keeps a summary that can be consumed by finance, ERP or reporting.

4.3. Teams‑first experience for approvers

Most approvers live in Microsoft Teams more than in the Power Automate portal. Combine Approvals with Teams notifications:

• After Create an approval (v2), add Post adaptive card and wait for a response (Teams connector) if your license and configuration support it.
• Use an adaptive card that shows:
  • Vendor name
  • Invoice number
  • Total amount
  • Cost center
  • Link to invoice file

The Approvals connector already surfaces approvals in Teams, but a custom adaptive card gives you more control over layout and extra actions (e.g. “Request clarification”). Use this path only if you’re comfortable maintaining JSON adaptive card payloads.

5. Escalations, reminders and edge cases

Approval flows break down in practice when invoices sit for days without a decision. You want predictable behaviour:

• Reminders after N days
• Escalation for high‑value invoices
• Timeout behaviour when the approver is unavailable

5.1. Timeouts using Delay and Condition

The Approvals connector doesn’t auto‑expire approvals, but your flow can enforce a policy.

Pattern:

1. After Create an approval (v2), run Parallel branches:

   • Branch A: Wait for an approval (v2) and process the result.
   • Branch B: Delay for a defined period (e.g. P2D for two days), then check whether the item is still Pending.

2. In Branch B, after Delay:

   • Get item from the KSeF Invoices list.
   • If ApprovalStatus = "Pending", send a reminder email or Teams message to the approver.

If you want escalation after more days, chain another Delay and Condition and update Approver to an escalation approver, then create a new approval.

5.2. High‑value invoices: multi‑stage approvals

For invoices above a threshold (e.g. 100k PLN), you may require two approvals:

1. First approver: cost center owner.
2. Second approver: finance manager.

Implementation:

• Add a Condition after intake based on TotalGross.
• If TotalGross is above threshold, set ApprovalStatus = "Pending – Level1".
• First flow handles Level 1:
  • On Pending – Level1, assign to cost center owner, run approval.
  • On approval, update to Pending – Level2 and set Approver to finance manager.
• Second branch (or second flow) is triggered by Pending – Level2 and runs the same pattern.

Keep status values explicit (Pending – Level1, Pending – Level2) so finance can see where an invoice is stuck.

6. Output: making approvals consumable by ERP and reporting

The approval flow is only useful if its result drives downstream behaviour.

6.1. ERP integration options

Common patterns:

• ERP reads the SharePoint list directly via API or OData.
• A scheduled Power Automate flow polls for ApprovalStatus = "Approved" and calls an ERP API endpoint to create a posting document.

If you use the HTTP connector to call ERP APIs:

• Make sure you handle errors and retries.
• Log any integration failures back on the list item (e.g. PostingStatus, PostingErrorMessage).

6.2. Power BI reporting on KSeF approvals

A simple but powerful addition: build a Power BI report on top of the KSeF Invoices list.

Useful visuals:

• Count of invoices by ApprovalStatus and CostCenter.
• Average approval time (difference between Created and time of status change to Approved).
• Aging buckets for Pending invoices.

This gives finance and management a clear view of bottlenecks and helps justify process changes (e.g. more approvers in some cost centers).

7. Security and compliance considerations

KSeF itself has strong cryptographic requirements, but by the time Power Automate sees the data, the critical part is protecting invoice content and metadata.

Key points:

• Storage location: host the XML and PDFs in a controlled SharePoint site with appropriate permissions.
• List permissions: restrict who can edit approval status; approvers should change status only via the flow, not manually.
• Connection ownership: use service accounts for critical connectors (SharePoint, Teams, HTTP to ERP) to avoid flows breaking when someone leaves.
• Environment strategy: build and test flows in a non‑production environment, then deploy to production using solutions. This keeps KSeF‑related automation manageable at scale.

If you’re in a regulated environment, work with your security team to validate that the integration layer handling .p12 and XAdES is appropriately hardened and audited. Power Automate should not be used to directly manage KSeF cryptographic operations.

8. One practical takeaway

Before KSeF becomes fully mandatory for your organisation, make sure you have a single, structured approval flow for KSeF invoices, even if your KSeF integration is still evolving. Get the basics in place: a tracking list, a standard Approvals‑based flow, clear status values and simple routing. You can refine XML parsing and ERP integration later, but a clean approval trail is the part your finance team is missing right now.