QES for business with employees: how to register cashiers, change keys, and avoid penalties in PRRO

QES in business in 2026: when a token is needed, how to issue signatures for employees, and what to do after changing a key

The issue of transitioning from EDS to QES for business has long ceased to be a "future reform". The Law of Ukraine No. 2155-VIII established a new model of electronic trust services back on November 7, 2018, and old electronic digital signatures and enhanced certificates issued under the previous law could only be used until their expiration date, but no later than two years from the date this law came into force. Therefore, in 2026, the practical question for an entrepreneur sounds different: not "do I need to switch from EDS", but "do I have a valid QES, are the signatories properly registered, and are the necessary certificates entered into the services with which the business operates" (Law of Ukraine).

An electronic document still has full legal force today, provided the requirements of the law are met. The law on electronic documents explicitly states that the legal force of an electronic document cannot be denied solely because of its electronic form, and the admissibility of such a document as evidence cannot be rejected for this reason alone. For business, this means that contracts, acts, applications, reporting, and internal documents can be drawn up and stored in electronic form if the author, signatory, and document exchange procedure are properly determined (Law of Ukraine).

It is necessary to check not only the file or cloud key itself, but also the provider's status. The official source for this is the Trust List of the Central Certification Authority. It is there that the list of qualified electronic trust service providers and information about their services is contained. If a business uses a signature from a bank, tax office, or other provider, the provider should be checked against this list, not against promotional descriptions of the service (czo.gov.ua).

Is it necessary to buy a token

A token is a secure medium for a private key, that is, a qualified electronic signature tool that not only stores the key but also protects it from copying and unauthorized access. The law and subordinate acts explicitly establish the obligation to use secure means primarily for state authorities, local self-government bodies, enterprises, institutions, and organizations of state ownership, as well as for state registrars, notaries, and other entities authorized by the state to perform the functions of a state registrar (Law of Ukraine).

For most individual entrepreneurs and private companies, the law does not explicitly establish a general obligation to buy a token solely due to the fact of using a QES. In practice, this means that private businesses can work with file or cloud keys unless a specific service, industry rules, or counterparty requirements demand a secure medium. For PRRO, the STS separately explains that the notification in form No. 5-PRRO is filled out on the basis of the key certificate, regardless of the key type (Law of Ukraine).

For whom in the business should signatures be issued

For an individual entrepreneur without employees, the entrepreneur's personal QES is usually sufficient for reporting, corresponding with regulatory authorities, signing contracts, and working in electronic services. If an individual entrepreneur uses PRRO independently, the key whose certificate data is entered into the PRRO Register must be used in settlement operations. The STS explicitly states that only keys of those persons whose certificates are entered in the register and are valid at the time of the settlement operation can be used in PRRO (tax.gov.ua).

If an individual entrepreneur or legal entity has cashiers, senior cashiers, an accountant, or other employees delegated with signature rights, they need separate signatures or other properly formalized signing tools depending on their role. For electronic document flow with the STS, information about such persons is submitted in a separate notification, and for PRRO, the certificates of those employees who will actually work in the cash register contour are entered separately. In form J(F)1391104, the tax office provides signature types "director", "accountant", "signature of tax invoices", "seal", and for PRRO, form J/F1391802 provides the roles "cashier", "senior cashier", or "termination of work" (lv.tax.gov.ua).

The private key must remain under the control of the very employee or entrepreneur for whom it was issued. The STS explicitly states that remote generation of new certificates is possible only when the private key is accessible only to the user and has not been compromised. For business, this practical rule means that passwords to keys should not be distributed centrally within the company, and work with signatures should be separated by roles, rather than having "one key for everyone" (ca.tax.gov.ua).

What to do after changing a key

When a business obtains a new QES, this is not enough on its own. If it is about electronic document exchange with regulatory authorities, a notification must be submitted providing information on the qualified or advanced electronic signature based on a qualified electronic signature certificate, using form J1391104 or F1391104. As of March 5, 2026, it is exactly form F1391104 that is listed in the register of electronic forms of the STS for individuals, and the tax authority separately explains the procedure for filling it out and signing it (tax.gov.ua).

For PRRO, this notification is insufficient. The data of certificates used in PRRO are entered into the PRRO Register on the basis of a separate notification in form No. 5-PRRO, the electronic identifiers of which are J1391802/F1391802. If the key has expired or the business has generated a new key for a cashier, senior cashier, or PRRO seal, a new notification with the identifier of the new certificate must be submitted. Without this, the correct operation of the cash register contour is not ensured (tr.tax.gov.ua).

That is why it is advisable for a company to keep an internal register of signatories: who has the right to sign reports, who works in PRRO, when the certificate expires, who is responsible for the timely update of keys, and who submits official notifications to the STS. For a business with several retail outlets or shifts, this is not a formality, but a way to avoid halting sales due to a technical or organizational error (tax.gov.ua).

What to do if a key is lost, password forgotten, or there is a risk of compromise

In the event of a lost key, suspicion of unauthorized access, loss of the medium, or other signs of compromise, the certificate must be immediately blocked or revoked with your electronic trust service provider. The STS QCEDP explicitly provides several mechanisms: an electronic request, a written application, and for blocking — also a telephone appeal with voice authentication. A revoked certificate cannot be renewed (ca.tax.gov.ua).

If the key belonged to an employee who has resigned or no longer has the right to sign, the business must act in two areas at once. First, revoke or block the certificate with the provider. Second, update the data on signatories with the STS, and for PRRO cashiers — submit a notification in form No. 5-PRRO with the role "Termination of work" or enter a new key instead of the old one. The STS explicitly notes that a notification with the type "Termination of work" for a cashier's key is not submitted if the key has already expired or has already been revoked, but upon the appearance of a new key for work in PRRO, a new notification with the current certificate must be submitted (evp.tax.gov.ua).

QES and document flow within the company

An electronic document is considered a full-fledged document if it contains the mandatory requisites, and the application of an electronic signature completes its creation. At the same time, the business must store electronic documents on media in a format that allows verifying their integrity, and the storage period cannot be less than for corresponding paper documents. This is important not only for tax reporting, but also for contracts, acts, personnel documents, correspondence with counterparties, and sales documents (Law of Ukraine).

For an entrepreneur or company, the correct organization of signatures comes down to four rules: each role has its own signature, the validity of certificates is monitored in advance, after changing a key, data in the STS and PRRO are immediately updated, and electronic documents are stored in such a way that they can be verified and provided upon request. Exactly this model reduces the risk of halting reporting, blocking cash operations, and disputes over who exactly signed a document (ca.tax.gov.ua).

Risks for settlements and reporting

If a business conducts settlement operations in violation of the rules for using RRO/PRRO, financial liability occurs under Article 17 of Law No. 265/95-VR. Therefore, a problem with keys in the cash register contour is not just a technical inconvenience. If a cashier works without a properly entered certificate, if the PRRO is configured with an invalid key, or if a key update is not reflected in the STS registers, this creates a direct compliance risk for settlements (Law of Ukraine).

For tax reporting, the risk is different: a document may not be accepted if the business has not updated the information about signatories or has submitted a notification violating the order of applying signatures. The tax authority separately describes who exactly and in what sequence signs the J(F)1391104 notification, and in the Electronic Cabinet, the processing result is recorded in receipts. Consequently, obtaining a new QES without subsequent registration in the accounting systems and services of the STS is an incomplete procedure (lv.tax.gov.ua).

Where is QES used in Торгсофт?

In the Торгсофт program, a qualified electronic signature (QES or EDS) is primarily used for the fiscalization of trade operations, electronic document flow, and interaction with government agencies. Here are the main areas of QES usage:

Official sources

Програма обліку товару для інтернет-магазинів, крамниць, торгових точок, складів та виробництва