FISK 2.0 Path Decision Research — 2026-05-10

Bilko HR FISK Research 2026-05-10

MC #8207 — Path Decision Data

Test file to confirm writes work.

Bilko FISK 2.0 Integration — CEO Path Decision Research

Date: 2026-05-10 MC: 8207 Author: Datavera sub-agent Status: RESEARCH COMPLETE — PENDING CEO DECISION

EXECUTIVE SUMMARY

Top recommendation: PATH B (Partner integration) via Sveracun or Moj-eRacun. Confidence: HIGH. Score: Path B = 25/30 | Path C = 22/30 | Path A = 11/30.

DELIVERABLE 1: Certified Informacijski Posrednici (Official List)

Source: https://porezna-uprava.gov.hr/hr/popis-informacijskih-posrednika/8019 Verified: 2026-05-10. Total entries: 34 certified intermediaries.

Legal definition (verbatim): "Informacijski posrednik je pravna ili fizicka osoba kojoj je dodijeljen OIB i koja usluzno pruzˇa drugima usluge izdavanja i zaprimanja eRacuna te pratecih isprava, fiskalizacije eRacuna, a moze pruzati i usluge eIzvjestavanja i/ili metapodatkovnih servisa."

KEY LEGAL FACT: Foreign companies CAN be certified posrednici with Croatian OIB. Evidence: OpusCapita Oy (Finland OIB 52424909202), ECOSIO GMBH (Austria OIB 32586971314), MARKANT SERVICES INTERNATIONAL GMBH (Austria OIB 29071087912), Unimaze ehf. Podruznica Zagreb (Iceland OIB 23184100315), EDICOM Spain (OIB 08861845000) — all on official list.

TOP 7 PARTNERS:

1. FINA (Financijska agencija) | OIB 85821130368 | Fina e-Racun B2B/B2G | 0800 0880
2. ELEKTRONICKI RACUNI d.o.o. (Moj-eRacun) | OIB 42889250808 | mer | +38517777810
3. PostLink d.o.o. (Sveracun) | OIB 53625326797 | Sveracun | +38514101130
4. Megatrend Redok d.o.o. | OIB 93809374555 | Redok eInvoice | +38514091288
5. ZZI d.o.o. | OIB 98034145705 | bizBox | +38518801150
6. EDITEL d.o.o. | OIB 83968467490 | Editel eXite | +38516463591
7. EDICOM (Spain) | OIB 08861845000 | EDICOM SaaS Solutions | +34961366565

ADDITIONAL NOTABLE (for SaaS integration):

• Fonoa Technologies d.o.o. (OIB 63433918405) — global compliance API, HR subsidiary
• ECOSIO GMBH (OIB 32586971314) — Austrian EDI platform
• MAXKO d.o.o. (OIB 52552659001) — eRacun.eu, Croatian SMB focus

DELIVERABLE 2: Moj-eRacun Deep-Dive

Company: ELEKTRONICKI RACUNI d.o.o., Zagreb Website: https://portal.moj-eracun.hr OIB: 42889250808 | Phone: +38517777810 Status: Officially certified posrednik | "Najkorišteniji posrednik u Hrvatskoj"

SERVICES: eRacun sending/receiving (B2B, B2G, B2C), Fiscalization 2.0, eArchive (11yr), DMS

API STATUS: NOT publicly documented. Available on-request to registered partners. Developer portal (kreirajapp.moj-eracun.hr) exists but requires registration. developer.moj-eracun.hr redirects to main portal — no separate dev docs found. API type (REST/SOAP) UNCONFIRMED — requires direct contact.

PRICING: "Paket po mjeri" (custom packages only). Receiving is FREE. Sending = custom pricing. For Bilko volume (250-10,000 invoices/month): negotiated — no published tiers.

KEY FACT FOR BILKO: Bilko does NOT need Croatian d.o.o. to call Moj-eRacun API. Bilko (Norwegian company) calls their API. Moj-eRacun holds the posrednik cert.

Partnership contact: prodajna-podrska@moj-eracun.hr / +38517777810

DELIVERABLE 3: Sveracun (PostLink d.o.o.) — CONFIRMED PRICING

Company: PostLink d.o.o. | Address: Jurisiceva 13, Zagreb 10000 Website: https://www.sveracun.hr | OIB: 53625326797 Phone: +385 1 410 1130 | Email: info@sveracun.hr Status: Officially certified posrednik

CONFIRMED PREPAID PRICING (source: https://www.sveracun.hr/cjenik, verified 2026-05-10): No monthly minimum. Bundles valid 1 year. Includes send+receive+fiscalize+report+archive.

MINI: 120 invoices/year = 54.00 EUR excl. VAT (0.45 EUR/invoice) PLUS: 360 invoices/year = 144.00 EUR excl. VAT (0.40 EUR/invoice) PRO: 720 invoices/year = 259.20 EUR excl. VAT (0.36 EUR/invoice) MAX: 1200 invoices/year = 408.00 EUR excl. VAT (0.34 EUR/invoice)

API: Available on-request ("API dokumentacija dostupna je na zahtjev")

TECHNICAL MODEL (confirmed from Sveracun website): "Sve sto vam je potrebno je: a) aktivna registracija, b) F1 certifikat, c) ovlastenje za fiskalizaciju u FiskAplikaciji." = Customer holds their own F1 cert. Customer grants authorization to Sveracun in FiskAplikacija. Sveracun then submits invoices on behalf of customer. Standard Croatian model.

DELIVERABLE 4: Path C Feasibility (Italy SDI-Style)

ITALY SDI vs CROATIA COMPARISON:

Italy: Intermediary accreditation OPTIONAL. Any software can send via SDI if technically compliant. Software houses commonly hold delegated signing rights. No mandatory cert list.

Croatia: 34 state-certified posrednici (mandatory registration). Regulated under cybersecurity law (NIS2 equivalent — "kljucni subjekti"). Strict cert custody rules.

CRITICAL FINA RULING (source: https://www.fina.hr/poslovni-digitalni-certifikati/poslovni-certifikati-za-fiskalizaciju): "Certifikat moze zatraziti obveznik fiskalizacije. Informaticka tvrtka koja implementira sustav fiskalizacije NE MOZE umjesto obveznika zatraziti certifikat." = The FINA fiscal certificate can ONLY be requested by the taxpayer. Bilko CANNOT request it.

PATH C REALITY:

• Customer holds FINA F1 cert (software cert, no hardware USB required)
• Customer registers in FiskAplikacija and grants ovlastenje to chosen posrednik
• Posrednik fiscalizes using customer's OIB + their certified platform
• Bilko generates UBL XML: YES feasible
• Customer signs with their own cert: YES
• Customer submits via MIKROeRACUN (free govt app): YES
• Bilko holds or manages certs: NO (FINA prohibition)
• Bilko submits without being certified posrednik: NO

BILKO-SPECIFIC PATH C BLOCKERS:

1. ZKI generation requires OIB in plaintext — L4-A encrypted per security policy; audit exception needed
2. MD5 in ZKI prohibited per DATA-ENCRYPTION-POLICY.md line 222 — architectural exception required
3. Customer FiskAplikacija setup is per-customer manual burden
4. No Balkan SaaS vendor precedent for Path C found

PATH C CONCLUSION: Legally possible as tool, but cannot submit without routing through posrednik. Path C effectively becomes Path B with more customer burden and no reduction in complexity.

DELIVERABLE 5: Croatian d.o.o. Incorporation Cost + Timeline (Path A Only)

Sources: Croatian START portal (start.gov.hr), FINA, secondary agency data.

COST BREAKDOWN:

• Minimum share capital: 2,654.46 EUR (HRK 20,000 equivalent, since 2013)
• Court registration fee: 350-500 EUR
• Notary fees (foreign founders): 500-1,500 EUR
• Attorney/agent fee: 1,500-3,000 EUR
• OIB assignment: Free
• FINA fiscal cert per customer: ~70-150 EUR / 5yr period (estimate) TOTAL INCORPORATION: 4,500-8,000 EUR one-time

ANNUAL ONGOING:

• Croatian bookkeeper/accountant: 150-400 EUR/month (legally required for RGFI filings)
• Corporate tax: 10% if revenue under 1M EUR; 18% above
• VAT mandatory threshold: 60,000 EUR turnover

TIMELINE:

• Croatian citizens via START: 2-3 business days (requires Croatian e-ID — NOT available to ALAI)
• Foreign founders: 30-60 business days via court — requires notarized POA, apostille, Croatian translation
• OIB assignment: 1-3 days after court registration
• Posrednik certification AFTER d.o.o.: Additional 60-120 days (Porezna uprava evaluation + NIS2 compliance) TOTAL PATH A TIMELINE: 6-12 months minimum from today (2026-05-10)

DELIVERABLE 6: Final Recommendation Matrix

SCORES (1=worst, 5=best):

DIMENSION | PATH A | PATH B | PATH C Time to first live HR customer | 1 | 5 | 3 Annual cost | 2 | 5 | 4 Legal liability exposure | 1 | 4 | 3 Engineering complexity | 2 | 4 | 3 Multi-market reusability | 3 | 4 | 4 CEO control / lock-in risk | 2 | 3 | 5 TOTAL | 11 | 25 | 22

RECOMMENDATION: PATH B — Partner Integration

PRIMARY PARTNER: Sveracun (PostLink d.o.o.)

• Only partner with PUBLICLY CONFIRMED per-invoice pricing: 0.34-0.45 EUR/invoice
• API on-request
• Transparent pricing for Bilko to build reseller margin
• Contact: info@sveracun.hr / +385 1 410 1130

SECONDARY PARTNER: Moj-eRacun (ELEKTRONICKI RACUNI d.o.o.)

• Largest market presence in Croatia ("najkorišteniji posrednik")
• Custom packages possible for SaaS resellers
• Contact: +38517777810

TERTIARY (for multi-country scale): EDICOM or Fonoa Technologies

• Both certified in Croatia and operate in multiple EU/Balkan markets
• API-first; multilingual support

PER-DIMENSION RATIONALE: Time: Path B = 60-90 days; Path A = 6-12 months Cost: Path B = zero ALAI fixed; per-invoice passthrough with markup possible Liability: Path B partner absorbs cert custody + 500,000 EUR fine exposure Engineering: Path B = one API call/invoice; Path A = ZKI crypto + mTLS + cert KMS + outbox Reusability: Partner model replicable in RS (SEF has certified operators); Path C ZKI also reusable Control: Path C wins on autonomy but customer burden offsets at Bilko's early scale

OPEN QUESTIONS FOR DIRECT VENDOR CONTACT

1. Sveracun API: Multi-tenant model? REST or SOAP? Rate limits? Contact: info@sveracun.hr
2. Moj-eRacun: SaaS reseller/white-label terms? Volume pricing 250-10,000/month? +38517777810
3. EDICOM: Croatia reseller program pricing? REST API docs? +34961366565
4. APIS-IT: Is eRacun 2.0 REST or SOAP? Existing SOAP endpoint cistest.apis-it.hr:8449 is Fiscalization 1.0 (B2C). eRacun 2.0 may use Peppol/AS4 for inter-posrednik or different endpoint. Contact: fiskalizacija.help@apis-it.hr
5. Posrednik certification process (Path A only): Exact criteria, timeline, cost from Porezna uprava
6. ZKI in Path B: Does posrednik API compute ZKI server-side, or must Bilko generate locally?

BILKO CODEBASE: MINIMUM PATH B CHANGES

1. Replace Error throw at fisk/index.ts line 103 with posrednik API HTTP call
2. Add jir, fiskStatus fields to Invoice model in schema.prisma (currently absent)
3. Add HR equivalent of SEFSubmissionQueue (Serbia outbox pattern at lines 600-618)
4. Change FISKConfig.certificatePath: string to posrednik API credentials config
5. Fix getInvoiceStatus() returning 'pending' as terminal — poll posrednik for JIR
6. Remove/separate legacy SOAP endpoint cistest.apis-it.hr:8449 (Fiscalization 1.0, not 2.0)
7. Add UI: customer onboarding flow for FiskAplikacija authorization confirmation