FISK 2.0 Path Decision Research — 2026-05-10 Bilko HR FISK Research 2026-05-10 MC #8207 — Path Decision Data Test file to confirm writes work. Bilko FISK 2.0 Integration — CEO Path Decision Research Date: 2026-05-10 MC: 8207 Author: Datavera sub-agent Status: RESEARCH COMPLETE — PENDING CEO DECISION EXECUTIVE SUMMARY Top recommendation: PATH B (Partner integration) via Sveracun or Moj-eRacun. Confidence: HIGH. Score: Path B = 25/30 | Path C = 22/30 | Path A = 11/30. DELIVERABLE 1: Certified Informacijski Posrednici (Official List) Source: https://porezna-uprava.gov.hr/hr/popis-informacijskih-posrednika/8019 Verified: 2026-05-10. Total entries: 34 certified intermediaries. Legal definition (verbatim): "Informacijski posrednik je pravna ili fizicka osoba kojoj je dodijeljen OIB i koja usluzno pruzˇa drugima usluge izdavanja i zaprimanja eRacuna te pratecih isprava, fiskalizacije eRacuna, a moze pruzati i usluge eIzvjestavanja i/ili metapodatkovnih servisa." KEY LEGAL FACT: Foreign companies CAN be certified posrednici with Croatian OIB. Evidence: OpusCapita Oy (Finland OIB 52424909202), ECOSIO GMBH (Austria OIB 32586971314), MARKANT SERVICES INTERNATIONAL GMBH (Austria OIB 29071087912), Unimaze ehf. Podruznica Zagreb (Iceland OIB 23184100315), EDICOM Spain (OIB 08861845000) — all on official list. TOP 7 PARTNERS: FINA (Financijska agencija) | OIB 85821130368 | Fina e-Racun B2B/B2G | 0800 0880 ELEKTRONICKI RACUNI d.o.o. (Moj-eRacun) | OIB 42889250808 | mer | +38517777810 PostLink d.o.o. (Sveracun) | OIB 53625326797 | Sveracun | +38514101130 Megatrend Redok d.o.o. | OIB 93809374555 | Redok eInvoice | +38514091288 ZZI d.o.o. | OIB 98034145705 | bizBox | +38518801150 EDITEL d.o.o. | OIB 83968467490 | Editel eXite | +38516463591 EDICOM (Spain) | OIB 08861845000 | EDICOM SaaS Solutions | +34961366565 ADDITIONAL NOTABLE (for SaaS integration): Fonoa Technologies d.o.o. (OIB 63433918405) — global compliance API, HR subsidiary ECOSIO GMBH (OIB 32586971314) — Austrian EDI platform MAXKO d.o.o. (OIB 52552659001) — eRacun.eu, Croatian SMB focus DELIVERABLE 2: Moj-eRacun Deep-Dive Company: ELEKTRONICKI RACUNI d.o.o., Zagreb Website: https://portal.moj-eracun.hr OIB: 42889250808 | Phone: +38517777810 Status: Officially certified posrednik | "Najkorišteniji posrednik u Hrvatskoj" SERVICES: eRacun sending/receiving (B2B, B2G, B2C), Fiscalization 2.0, eArchive (11yr), DMS API STATUS: NOT publicly documented. Available on-request to registered partners. Developer portal (kreirajapp.moj-eracun.hr) exists but requires registration. developer.moj-eracun.hr redirects to main portal — no separate dev docs found. API type (REST/SOAP) UNCONFIRMED — requires direct contact. PRICING: "Paket po mjeri" (custom packages only). Receiving is FREE. Sending = custom pricing. For Bilko volume (250-10,000 invoices/month): negotiated — no published tiers. KEY FACT FOR BILKO: Bilko does NOT need Croatian d.o.o. to call Moj-eRacun API. Bilko (Norwegian company) calls their API. Moj-eRacun holds the posrednik cert. Partnership contact: prodajna-podrska@moj-eracun.hr / +38517777810 DELIVERABLE 3: Sveracun (PostLink d.o.o.) — CONFIRMED PRICING Company: PostLink d.o.o. | Address: Jurisiceva 13, Zagreb 10000 Website: https://www.sveracun.hr | OIB: 53625326797 Phone: +385 1 410 1130 | Email: info@sveracun.hr Status: Officially certified posrednik CONFIRMED PREPAID PRICING (source: https://www.sveracun.hr/cjenik, verified 2026-05-10): No monthly minimum. Bundles valid 1 year. Includes send+receive+fiscalize+report+archive. MINI: 120 invoices/year = 54.00 EUR excl. VAT (0.45 EUR/invoice) PLUS: 360 invoices/year = 144.00 EUR excl. VAT (0.40 EUR/invoice) PRO: 720 invoices/year = 259.20 EUR excl. VAT (0.36 EUR/invoice) MAX: 1200 invoices/year = 408.00 EUR excl. VAT (0.34 EUR/invoice) API: Available on-request ("API dokumentacija dostupna je na zahtjev") TECHNICAL MODEL (confirmed from Sveracun website): "Sve sto vam je potrebno je: a) aktivna registracija, b) F1 certifikat, c) ovlastenje za fiskalizaciju u FiskAplikaciji." = Customer holds their own F1 cert. Customer grants authorization to Sveracun in FiskAplikacija. Sveracun then submits invoices on behalf of customer. Standard Croatian model. DELIVERABLE 4: Path C Feasibility (Italy SDI-Style) ITALY SDI vs CROATIA COMPARISON: Italy: Intermediary accreditation OPTIONAL. Any software can send via SDI if technically compliant. Software houses commonly hold delegated signing rights. No mandatory cert list. Croatia: 34 state-certified posrednici (mandatory registration). Regulated under cybersecurity law (NIS2 equivalent — "kljucni subjekti"). Strict cert custody rules. CRITICAL FINA RULING (source: https://www.fina.hr/poslovni-digitalni-certifikati/poslovni-certifikati-za-fiskalizaciju): "Certifikat moze zatraziti obveznik fiskalizacije. Informaticka tvrtka koja implementira sustav fiskalizacije NE MOZE umjesto obveznika zatraziti certifikat." = The FINA fiscal certificate can ONLY be requested by the taxpayer. Bilko CANNOT request it. PATH C REALITY: Customer holds FINA F1 cert (software cert, no hardware USB required) Customer registers in FiskAplikacija and grants ovlastenje to chosen posrednik Posrednik fiscalizes using customer's OIB + their certified platform Bilko generates UBL XML: YES feasible Customer signs with their own cert: YES Customer submits via MIKROeRACUN (free govt app): YES Bilko holds or manages certs: NO (FINA prohibition) Bilko submits without being certified posrednik: NO BILKO-SPECIFIC PATH C BLOCKERS: ZKI generation requires OIB in plaintext — L4-A encrypted per security policy; audit exception needed MD5 in ZKI prohibited per DATA-ENCRYPTION-POLICY.md line 222 — architectural exception required Customer FiskAplikacija setup is per-customer manual burden No Balkan SaaS vendor precedent for Path C found PATH C CONCLUSION: Legally possible as tool, but cannot submit without routing through posrednik. Path C effectively becomes Path B with more customer burden and no reduction in complexity. DELIVERABLE 5: Croatian d.o.o. Incorporation Cost + Timeline (Path A Only) Sources: Croatian START portal (start.gov.hr), FINA, secondary agency data. COST BREAKDOWN: Minimum share capital: 2,654.46 EUR (HRK 20,000 equivalent, since 2013) Court registration fee: 350-500 EUR Notary fees (foreign founders): 500-1,500 EUR Attorney/agent fee: 1,500-3,000 EUR OIB assignment: Free FINA fiscal cert per customer: ~70-150 EUR / 5yr period (estimate) TOTAL INCORPORATION: 4,500-8,000 EUR one-time ANNUAL ONGOING: Croatian bookkeeper/accountant: 150-400 EUR/month (legally required for RGFI filings) Corporate tax: 10% if revenue under 1M EUR; 18% above VAT mandatory threshold: 60,000 EUR turnover TIMELINE: Croatian citizens via START: 2-3 business days (requires Croatian e-ID — NOT available to ALAI) Foreign founders: 30-60 business days via court — requires notarized POA, apostille, Croatian translation OIB assignment: 1-3 days after court registration Posrednik certification AFTER d.o.o.: Additional 60-120 days (Porezna uprava evaluation + NIS2 compliance) TOTAL PATH A TIMELINE: 6-12 months minimum from today (2026-05-10) DELIVERABLE 6: Final Recommendation Matrix SCORES (1=worst, 5=best): DIMENSION | PATH A | PATH B | PATH C Time to first live HR customer | 1 | 5 | 3 Annual cost | 2 | 5 | 4 Legal liability exposure | 1 | 4 | 3 Engineering complexity | 2 | 4 | 3 Multi-market reusability | 3 | 4 | 4 CEO control / lock-in risk | 2 | 3 | 5 TOTAL | 11 | 25 | 22 RECOMMENDATION: PATH B — Partner Integration PRIMARY PARTNER: Sveracun (PostLink d.o.o.) Only partner with PUBLICLY CONFIRMED per-invoice pricing: 0.34-0.45 EUR/invoice API on-request Transparent pricing for Bilko to build reseller margin Contact: info@sveracun.hr / +385 1 410 1130 SECONDARY PARTNER: Moj-eRacun (ELEKTRONICKI RACUNI d.o.o.) Largest market presence in Croatia ("najkorišteniji posrednik") Custom packages possible for SaaS resellers Contact: +38517777810 TERTIARY (for multi-country scale): EDICOM or Fonoa Technologies Both certified in Croatia and operate in multiple EU/Balkan markets API-first; multilingual support PER-DIMENSION RATIONALE: Time: Path B = 60-90 days; Path A = 6-12 months Cost: Path B = zero ALAI fixed; per-invoice passthrough with markup possible Liability: Path B partner absorbs cert custody + 500,000 EUR fine exposure Engineering: Path B = one API call/invoice; Path A = ZKI crypto + mTLS + cert KMS + outbox Reusability: Partner model replicable in RS (SEF has certified operators); Path C ZKI also reusable Control: Path C wins on autonomy but customer burden offsets at Bilko's early scale OPEN QUESTIONS FOR DIRECT VENDOR CONTACT Sveracun API: Multi-tenant model? REST or SOAP? Rate limits? Contact: info@sveracun.hr Moj-eRacun: SaaS reseller/white-label terms? Volume pricing 250-10,000/month? +38517777810 EDICOM: Croatia reseller program pricing? REST API docs? +34961366565 APIS-IT: Is eRacun 2.0 REST or SOAP? Existing SOAP endpoint cistest.apis-it.hr:8449 is Fiscalization 1.0 (B2C). eRacun 2.0 may use Peppol/AS4 for inter-posrednik or different endpoint. Contact: fiskalizacija.help@apis-it.hr Posrednik certification process (Path A only): Exact criteria, timeline, cost from Porezna uprava ZKI in Path B: Does posrednik API compute ZKI server-side, or must Bilko generate locally? BILKO CODEBASE: MINIMUM PATH B CHANGES Replace Error throw at fisk/index.ts line 103 with posrednik API HTTP call Add jir, fiskStatus fields to Invoice model in schema.prisma (currently absent) Add HR equivalent of SEFSubmissionQueue (Serbia outbox pattern at lines 600-618) Change FISKConfig.certificatePath: string to posrednik API credentials config Fix getInvoiceStatus() returning 'pending' as terminal — poll posrednik for JIR Remove/separate legacy SOAP endpoint cistest.apis-it.hr:8449 (Fiscalization 1.0, not 2.0) Add UI: customer onboarding flow for FiskAplikacija authorization confirmation