Understanding Rule Classifications

Government-mandated rules

Derived directly from the VAT Act (ustawa o podatku od towarów i usług), Art. 106e, and Ministry of Finance regulations. These represent regulatory requirements for FA(3) invoices under Polish tax law.

Our conformance testing revealed that 16 GOV_MANDATED rules are explicitly marked as KSeF-enforced at submission time. 50 GOV_MANDATED rules are explicitly Guard-only — legally binding requirements that KSeF does not validate at the API level. 5 critical GOV_MANDATED rules are non-disableable but not annotated in the ksef_enforced field.

• Severity: error (always)
• Disableable: 28 rules cannot be disabled (21 KSeF-confirmed + 7 critical). 50 configurable GOV_MANDATED rules can be disabled via configuration.

Best-practice recommendations

Recommended validations drawn from the official MF information brochure, common accounting standards, and patterns observed in production invoices. While not strictly illegal to violate, these rules catch issues that frequently lead to rejection or manual correction.

• Severity: error by default (configurable)
• Disableable: yes

Smart anomaly detection

Intelligent rules that flag suspicious but not necessarily illegal patterns. These catch human errors, data-entry anomalies, and timing inconsistencies that often indicate a mistake rather than intentional input.

• Severity: warning
• Disableable: yes

Data integrity and security

Security-focused rules that detect injection attempts, control characters, and other data-integrity issues that could indicate tampering or malformed input. These protect against XML-level attack vectors embedded within invoice text fields.

• Severity: error
• Disableable: partial (3 locked: BUS-163, BUS-201, BUS-202. 3 disableable: BUS-190, BUS-191, BUS-192)

Cross-invoice batch validation

Rules that only activate when validating multiple invoices at once. They detect inconsistencies across a batch — duplicate numbers, seller mismatches, chronological regressions, and advance/settlement mismatches.

• Severity: error
• Disableable: yes

Inferred logic rules

Rules derived from logical inference about correction invoice semantics. Not explicitly stated in regulations, but mathematically implied by the correction workflow.

• Severity: error
• Disableable: yes

KSeF enforcement vs. regulatory compliance

An important distinction revealed by our conformance testing: KSeF accepting an invoice does not mean it is legally compliant. The KSeF platform is primarily an XSD schema validator — 96% of its rejections are XML structure errors. It performs only a handful of semantic checks (date validation, NIP permissions).

This means 55 legal-requirement rules in KSeF Guard enforce requirements from the VAT Act that KSeF itself does not check. In conformance v9, KSeF accepted invoices violating these rules; they may still be flagged during tax audits by the National Revenue Administration (KAS).

Severity levels

Every triggered rule carries one of two severity levels:

Configuration

GOV_MANDATED rules confirmed by KSeF (marked with the Gov Enforced badge) and 3 core SECURITY rules cannot be disabled — these represent verified platform requirements and security protections. GOV_MANDATED rules not enforced by KSeF can be disabled via configuration, along with BEST_PRACTICE, HEURISTIC, INFERRED, and some BATCH_CHECK rules.

Built-in presets

Per-rule configuration

Individual rules can be toggled via a .ksef-guard.yml config file or CLI flags:

# CLI: disable a specific rule
ksef-guard validate --disable-rule KSEF-BUS-193 invoice.xml

# CLI: use a preset
ksef-guard validate --preset maximum ./invoices/

# .ksef-guard.yml
rules:
  KSEF-BUS-193:
    enabled: false
  KSEF-BUS-197:
    severity: error   # promote to error

Summary