Compliance Framework
Compliance Framework Document
Project: Bilko — Balkan Accounting SaaS
Version: 1.0
Date: 2026-02-23
Author: DPO / Compliance ArchitectOfficer
Status: Draft
Reviewers: DPO,CTO, Legal Counsel,Counsel CEO(RS, BA, HR)
Classification: Confidential
Document History
| Version |
Date |
Author |
Changes |
| 0.1 |
2026-02-23 |
Compliance ArchitectDPO |
Initial draft — RS/BA/HR three-country compliance mapping |
1. ApplicableCompliance RegulationsScope
ComplianceBilko Owner:is Compliancea Architectcloud ([email protected])accounting LastSaaS Review:operating 2026-02-23in |three Nextjurisdictions. Review:Each 2026-08-23has distinct data protection, accounting, tax, and e-invoicing requirements.
graph TD
subgraph Regulation |
Country |
Phase |
GDPR — Regulation (EU) 2016/679 |
HR |
Phase 1 |
Zakon o zaštiti podataka o ličnosti (ZZPL, Sl. glasnik RS 87/2018) |
RS |
Phase 2 |
Zakon o zaštiti ličnih podataka BiH (ZZLP, Sl. glasnik BiH 49/2006) |
BA |
Phase 3 |
Zakon o računovodstvu (Sl. glasnik RS 73/2019) |
RS |
Phase 2 |
Zakon o računovodstvu i reviziji FBiH (Sl. novine FBiH 83/2009) |
BA (FBiH) |
Phase 3 |
Zakon o računovodstvu i reviziji RS BiH (Sl. glasnik RS BiH 96/2005) |
BA (RS entity) |
Phase 3 |
Zakon o računovodstvu HR (NN 78/15, 120/16, 116/18) |
HR |
Phase 2 |
Zakon o PDV RS (Sl. glasnik RS 84/2004 et al.) |
RS |
Phase 2 |
Zakon o PDV BiH (Sl. glasnik BiH 9/2005 et al.) |
BA |
Phase 3 |
Zakon o porezu na dodanu vrijednost HR (NN 73/13 et al.) |
HR |
Phase 2 |
Zakon o elektronskom dokumentu RS (Sl. glasnik RS 51/2009) |
RS |
Phase 2 |
Opći porezni zakon HR (NN 115/16 et al.) |
HR |
Phase 2 |
Pravilnik o kontnom okviru RS (2021) |
RS |
Phase 2 |
FBiH Pravilnik o kontnom okviru (2022) |
BA (FBiH) |
Phase 3 |
RRiF Kontni plan HR |
HR |
Phase 2 |
2. RS["Serbia (RS)Republika —Srbija)"]
Regulatory Compliance
2.1 Data ProtectionRS_DP["ZZPL — Zakon o zaštiti podataka o ličnostiličnosti\nSl. glasnik RS 87/2018 (ZZPL)
GDPR-aligned)"]
FullRS_ACC["Zakon name:o računovodstvu\nSl. glasnik RS 73/2019"]
RS_VAT["Zakon o PDV\n20% / 10% / 0%"]
RS_SEF["SEF e-Invoice\nUBL 2.1 XML — B2B mandatory Jan 2023\nPenalty: 50K–2M RSD"]
RS_APR["APR Filing\nJune 30 deadline"]
end
subgraph BA["Bosnia & Herzegovina"]
BA_DP["ZZLP BiH — Zakon o zaštiti podatakaličnih podataka\nSl. glasnik BiH 49/2006"]
BA_FBiH["FBiH: Zakon o ličnostiračunovodstvu Citation:i reviziji FBiH\nSl. novine FBiH 83/2009 + Pravilnik 2022"]
BA_RSBA["RS entitet: Zakon o računovodstvu i reviziji RS BiH\nSl. glasnik RS BiH 96/2005"]
BA_VAT["Zakon o PDV BiH\n17% / 0% — UIO authority"]
BA_CPF["CPF e-Invoice\nPending ~2027"]
end
subgraph HR["Croatia (Hrvatska)"]
HR_DP["GDPR — directly applicable (EU member)\nUredba (EU) 2016/679"]
HR_ACC["Zakon o računovodstvu\nNN 78/15, 116/18, 42/20, 47/20, 114/22"]
HR_VAT["Zakon o porezu na dodanu vrijednost\n25% / 13% / 5% / 0%"]
HR_FISK["HR-FISK (eRačun B2G/B2B)\nFINA certificate — mandatory Jan 2026\nPenalty: up to EUR 500K"]
HR_FINA["FINA RGFI\nApril 30 deadline"]
end
2. Data Protection Compliance
2.1 Applicable Laws
| Jurisdiction |
Law |
Supervisory Authority |
Penalty |
| Serbia |
ZZPL (Sl. glasnik RS br.87/2018) |
87/2018
In force: November 21, 2018
Description: Serbia's GDPR-aligned personal data protection law.
Supervisory authority: Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti |
Up to 2M RSD (legal entity) |
| Bosnia & Herzegovina |
ZZLP BiH (Sl. glasnik BiH 49/2006) |
Agencija za zaštitu ličnih podataka (AZLP) |
Up to 10K BAM |
| Croatia |
GDPR Uredba (EU) 2016/679 |
Agencija za zaštitu osobnih podataka (AZOP) |
Up to €20M or 4% global turnover |
2.2 Legal Basis for Processing
| Data Category |
Legal Basis |
Jurisdiction |
| Account email, name |
Contract performance (Art. 6(1)(b) GDPR / Art. 12(1)(b) ZZPL) |
All |
| Tax IDs (PIB, JMBG, OIB, JIB) |
Legal obligation — accounting/tax law |
RS, BA, HR |
| IBAN, bank accounts |
Contract performance |
All |
| IP address, session logs |
Legitimate interest — security |
All |
| Financial transaction data |
Legal obligation — accounting/tax law |
All |
2.3 Data Subject Rights Implementation
| Right |
GDPR Article |
ZZPL Equivalent |
Status |
| Access |
Art. 15 |
Art. 26 |
Planned — /api/gdpr/export endpoint |
| Rectification |
Art. 16 |
Art. 27 |
In-app edit functionality |
| Erasure ("Right to be forgotten") |
Art. 17 |
Art. 28 |
Blocked by legal retention requirements |
| Portability |
Art. 20 |
Art. 30 |
Planned — JSON/CSV export |
| Restriction |
Art. 18 |
Art. 29 |
Planned — account suspension flow |
| Objection |
Art. 21 |
Art. 31 |
Via support ticket |
Website:Note on Erasure: https:Financial data cannot be erased during mandatory retention periods (10 years RS, 10-11 years BA, 11 years HR). Account can be anonymized (name/email) but transaction records must be kept.
2.4 Cross-Border Data Transfers
- Host: Railway EU West (Amsterdam /
/www.poverenik.rs Frankfurt) — within EEA
- HR → Railway: No transfer mechanism needed (EU to EU)
- RS → Railway: Serbia is on GDPR adequacy list (European Commission Decision 2023/1485)
- BA → Railway: No EU adequacy decision for BiH. Rely on Standard Contractual Clauses (SCC 2021/914) with Railway as processor.
2.5 DPA Requirements
Data Processing Agreements must be signed with:
- Railway (primary database host)
- Cloudflare (WAF, CDN — processes IP addresses)
- Sentry (error tracking — processes stack traces with potential PII)
- Any email service provider
3. Accounting & Tax Compliance
3.1 Serbia (RS)
| Requirement |
ZZPLLaw |
ArticleDetails |
Bilko Implementation |
LawfulChart basisof for processingAccounts |
Art.Pravilnik 12o kontnom okviru (Sl. glasnik RS 3/2020) |
ContractStandard (Art.Serbian 12 st. 1 tač. 2)CoA — accounting9 serviceclasses |
RS-specific CoA template preloaded on org creation |
DataVAT minimizationrates |
Art.Zakon 5o st.PDV 1(Sl. tač.glasnik 3RS 84/2004 + amendments) |
Email,20% name,standard, PIB/JMBG10% onlyreduced, where0% legallyexempt |
requiredVAT rate selector on invoice line items |
DataFinancial subject rightsstatements |
Art.Zakon 26-41o računovodstvu |
GETBilans /account/data,stanja DELETE+ /account,Bilans GETuspeha /account/(BS format) |
Export to APR-compliant XML/PDF |
| Mandatory e-invoicing |
Zakon o elektronskom fakturisanju (Sl. glasnik RS 44/2021) |
B2B mandatory since Jan 1, 2023 (≥4.5M RSD) |
SEF API integration (UBL 2.1 XML) |
| APR filing deadline |
Zakon o računovodstvu Art. 33 |
June 30 (full-year entities), March 31 (other) |
In-app reminder + export |
ProcessingRetention registerperiod |
Zakon o računovodstvu Art. 5026 |
Internal10 processingyears registerfor requiredfinancial statements and documentation |
Delete-prevention lock on records >0 days old |
SecurityPausal of processingregime |
Art.Zakon 50o paušalnom oporezivanju |
TLS<6M 1.3,RSD AES-256,annual bcrypt,income |
RBACSimplified invoice mode for pausal firms |
BreachPIO/health notificationcontributions |
Zakon o doprinosima |
Applied to Povereniksalaries |
Art.Future: 56 | payroll Within 72 hours of awarenessmodule |
BreachSEF notification:Integration: [email protected] | Bulevar kralja Aleksandra 15, 11000 Belgrade
- Portal: efaktura.mfin.gov.rs
- Format: UBL 2.1 XML (HR-CIUS compatible subset)
- Authentication: API key per organization
- Mandatory fields: seller PIB, buyer PIB, invoice number, date, amounts, VAT breakdown
2.3.2 AccountingBosnia Law& —Herzegovina Zakon o računovodstvu(BA)
Full name: Zakon o računovodstvu
Citation: Sl. glasnik RS br. 73/2019, 44/2021
| Requirement |
Law |
Details |
Bilko Implementation |
Double-entryFBiH bookkeepingCoA |
SchemaFBiH enforcesPravilnik debitAccountIdo računovodstvu (Sl. novine FBiH 89/2016 + creditAccountId2022 revision) |
FBiH-specific chart of accounts |
FBiH CoA template |
ChartRS entity CoA |
RS BiH Pravilnik |
RS entity chart of accounts: Pravilnik o kontnom okviruaccounts (2021)differs —from 10 class (0-9)FBiH) |
SerbianRS BiH CoA seed datatemplate |
BilansVAT stanja (Balance Sheet) + Bilans uspeha (Income Statement)rate |
PhaseZakon 2o reportsPDV BiH (Sl. glasnik BiH 9/2005) |
17% standard, 0% exempt — UIO authority |
VAT 17% selector |
Filing:VAT APR (https://www.apr.gov.rs), deadline June 30filing |
PDFUIO exportportal |
+Monthly/quarterly remindersPDV prijava |
Export to UIO-compatible format |
DocumentFiling retention: 10 yearsdeadline |
Soft delete — never hard delete financial data |
2.3 VAT — Zakon o PDV
Citation: Sl. glasnik FBiH/RS br.entity 84/2004 (consolidated)
Rate |
Description |
|---|
20% (opšta stopa)laws |
StandardMarch —31 general(most goodsentities) |
andIn-app servicesreminder |
10%FBiH (snižena stopa)retention |
ReducedZakon —o food,računovodstvu medicines,i utilitiesreviziji FBiH Art. 17 |
10 years |
Delete-prevention lock |
0%RS entity retention |
Exports,Zakon internationalo transportračunovodstvu i reviziji RS BiH Art. 16 |
11 years |
Delete-prevention lock |
| e-Invoice |
CPF platform (pending) |
Expected mandatory ~2027 |
Roadmap item |
| CIT rate |
Zakon o porezu na dobit FBiH |
10% flat |
Future: tax calculation module |
VATEntity threshold:detection: 8,000,000Bilko RSDmust |determine Return:if Monthlyan (>50Morganization RSD)is in FBiH, RS entity, or QuarterlyBrčko |District Deadline:to 15thapply ofthe nextcorrect month
CoA 2.4and E-Invoiceretention —rules. SEFOn (Sistemorg e-Faktura)
creation, Platform:user https://efaktura.gov.rsselects |entity. Mandatory:Brčko B2B since January 2023
Format: UBL 2.1 XML | Penalties: 50,000–2,000,000 RSD for non-compliance
Integration: @bilko/country-rs package (Phase 2)
2.5 APR Filing
Serbian entities file annual financial reports with APR (Agencija za privredne registre). Deadline: June 30. Bilko generates APR-compatible PDF/XML exports.
3. Bosnia & Herzegovina (BA) — Regulatory Compliance
Complexity:follows BiH has two entities (FBiH and Republika Srpska). VAT unified at state state-level via UIO. Direct taxes separate per entity.law.
3.13 Data Protection — Zakon o zaštiti ličnih podataka BiHCroatia (ZZLP)HR)
Full name: Zakon o zaštiti ličnih podataka Bosne i Hercegovine
Citation: Sl. glasnik BiH br. 49/2006, 76/2011, 89/2011
Supervisory authority: AZLP — Agencija za zaštitu ličnih podataka Bosne i Hercegovine
Website: https://www.azlp.ba
| Requirement |
ZZLPLaw |
ArticleDetails |
Bilko Implementation |
Lawful basisCoA |
Art. 4 |
Contract + legal obligation |
Security measures |
Art. 14 |
TLS 1.3, AES-256, bcrypt, RBAC |
Cross-border transfer |
Art. 18 |
Railway EU West — SCCs mechanism |
Breach notification to AZLP |
Art. 14 + GDPR practice |
72 hours |
Breach notification: [email protected] | Hamdije Čemerlića 2/VI, 71000 Sarajevo
3.2 FBiH — Accounting Law
Full name: Zakon o računovodstvu i reviziji Federacije Bosne i Hercegovine
Citation: Sl. novine FBiH br. 83/2009, 56/2023
Requirement |
Bilko Implementation |
|---|
Double-entry bookkeeping |
Schema enforced |
Chart of accounts: FBiH Pravilnik (2022) |
BiH CoA seed data |
Filing: Agency of Financial Information (FBiH), deadline March 31 |
PDF export |
Document retention: 10 years |
Immutable storage |
3.3 Republika Srpska (BA Entity)
Citation: Sl. glasnik RS BiH br. 96/2005, 74/2016
Filing: Tax Administration of RS (BiH entity), March 31
Retention: 11 years — maximum applied across BA entities
3.4 VAT — Zakon o PDV BiH
Citation: Sl. glasnik BiH br. 9/2005 (consolidated)
Authority: UIO — Uprava za indirektno oporezivanje | https://www.uino.gov.ba
Rate |
Description |
|---|
17% (opća stopa) |
Standard — all goods and services |
0% |
Exports |
Threshold: 100,000 BAM | Return: Monthly | No reduced rates
3.5 E-Invoice — CPF (Central Platform for Fiscalisation)
Status: PENDING — technical specifications not published
Law adopted: January 2026 (FBiH only)
Expected: ~2027
Bilko decision: DO NOT implement CPF until specs published. BiH is Phase 3 launch.
3.6 Corporate Income Tax
Entity |
Rate |
Deadline |
|---|
FBiH |
10% |
March 31 |
RS (BiH entity) |
10% |
March 31 |
4. Croatia (HR) — Regulatory Compliance
Note: Croatia is EU member state. GDPR applies directly.
4.1 Data Protection — GDPR
Applicable: GDPR Regulation (EU) 2016/679 (directly applicable)
National implementing act: Zakon o provedbi Opće uredbe (NN 42/2018)
Supervisory authority: AZOP — Agencija za zaštitu osobnih podataka | https://azop.hr
Requirement |
GDPR Article |
Bilko Implementation |
|---|
Lawful basis |
Art. 6 |
Contract (6.1.b) for service; legal obligation (6.1.c) for tax |
Data minimization |
Art. 5(1)(c) |
OIB, name, email only |
Right to access |
Art. 78/15 |
GETCroatian standard CoA (HSFI /api/v1/account/data |
MSFI for Rightlarge to erasure |
Art. 17 |
DELETE /api/v1/account |
Right to portability |
Art. 20 |
GET /api/v1/account/export |
Security of processing |
Art. 32 |
TLS 1.3, AES-256, bcrypt, RBAC |
Breach notification to AZOP |
Art. 33 |
Within 72 hours |
DPA with processors |
Art. 28 |
Railway, Vercel, Cloudflare, SendGrid |
Breach notification: [email protected] | https://azop.hr/prijavapovrede | Selska cesta 136, 10000 Zagreb
4.2 Accounting Law — Zakon o računovodstvu HR
Citation: NN 78/15, 120/16, 116/18, 42/20
Requirement |
Bilko Implementation |
|---|
Double-entry bookkeeping |
Schema enforced |
Chart of accounts: RRiF standardentities) |
HR CoA seed data |
Accounting standards: CFRS (SMEs) or IFRS (PIEs) |
CFRS-compliant reports |
Bilanca + Račun dobiti i gubitka |
Report generation Phase 2 |
Filing: FINA RGFI (https://www.fina.hr), deadline April 30 |
FINA-compatible export |
Document retention: 11 years |
Immutable storage |
4.3 General Tax Law — Opći porezni zakon HR
Citation: NN 115/16, 106/18, 121/19, 32/20
Document retention 11 years, electronic record acceptance, digital accounting system obligations.
4.4 VAT — Zakon o PDV HR
Citation: NN 73/13 et al. | Portal: ePorezna — https://www.porezna-uprava.hr
Rate |
Description |
|---|
25% (opća stopa) |
Standard — general goods and services |
13% (srednja stopa) |
Intermediate — foods, water, accommodation |
5% (snižena stopa) |
Reduced — books, baby food, medicines |
0% |
Exports, intra-EU supply |
Threshold: 60,000 EUR | Return: Monthly | Deadline: Last day of next month
4.5 E-Invoice — HR-FISK / eRačun
Platform: https://hr-fisk.fina.hr | Operator: FINA — Financijska agencija
Mandatory since: January 1, 2026 (all B2B, B2G, B2C)
Format: UBL 2.1 XML with HR-CIUS | Protocol: AS4 (Peppol-compatible)
Certificate: FINA qualified certificate required
Penalties: Up to EUR 500,000 for non-compliance
Archive: 11 years
Integration: @bilko/country-hr — FINA certificate + API (Phase 2)
4.6 Corporate Income Tax — Croatia
Standard rate: 18% | Reduced: 10% (revenue <1M EUR) | Deadline: April 30
5. Cross-Country Compliance Matrix
Requirement |
Serbia (RS) |
Bosnia & Herzegovina (BA) |
Croatia (HR) |
|---|
Data protection law |
ZZPL (GDPR-aligned, 2018) |
ZZLP BiH (2006) |
GDPR (directly applicable) |
Supervisory authority |
Poverenik |
AZLP |
AZOP |
Breach notification deadline |
72 hours (ZZPL Art. 56) |
72 hours (best practice) |
72 hours (GDPR Art. 33) |
VAT standard rate |
20% |
17% |
25% |
VAT reduced rate |
10% |
None |
13% / 5% |
E-invoice platform |
SEF (mandatory Jan 2023) |
CPF (pending ~2027) |
HR-FISK (mandatory Jan 2026) |
E-invoice format |
UBL 2.1 XML |
TBD |
UBL 2.1 XML (HR-CIUS) |
Annual report filing |
APR — June 30 |
Agency Fin. Info / Tax Admin — March 31 |
FINA RGFI — April 30 |
Chart of accounts |
Pravilnik (2021) |
FBiH Pravilnik (2022) |
RRiF standard |
Document retention |
10 years |
10 (FBiH) / 11 (RS entity) |
11 yearstemplate |
| Currency |
RSDSince Jan 2024: EUR only |
BAMHRK phased out. All amounts in EUR. |
EUR default for HR orgs |
CITVAT raterates |
15%Zakon o PDV (NN 73/13) |
10%25% standard, 13% (food/hotels), 5% (books/medicines), 0% |
18%VAT rate selector per line item |
| VAT filing |
Porezna uprava |
Monthly/quarterly PDV obrazac |
Export for manual filing (10%Porezna <1Muprava EUR)portal) |
| HR-FISK (eRačun) |
Zakon o elektroničkom izdavanju računa u javnoj nabavi (NN 94/18) + amendments |
Mandatory Jan 1, 2026 for B2B above threshold. FINA certificate required. UBL 2.1 XML HR-CIUS. Penalty up to EUR 500K |
HR-FISK API integration — Roadmap P2 |
| FINA RGFI filing |
Zakon o računovodstvu Art. 30 |
April 30 |
In-app reminder + FINA export |
| Retention |
Zakon o računovodstvu Art. 10 + Opći porezni zakon |
11 years |
Delete-prevention lock |
| Fiscalization 2.0 |
Pravilnik o fiskalizaciji |
Cash register fiscalization (if cash payments) |
Cash receipt module with Porezna uprava integration |
BilkoHR-FISK retention policy:Priority: ApplyCroatia's maximumeRačun acrossmandate all(Jan markets2026) —with 11EUR years500K penalty makes this the highest-priority e-invoicing integration. FINA certificate must be obtained during onboarding for allHR financial records. Never hard delete.organizations.
6.4. DataControls Classification SchemeRegister
LevelControl ID |
LabelDescription |
ExamplesType |
Controls | Applies
L1 |
Public |
Exchange rates, fee schedule, privacy policy |
None |
L2 |
Internal |
Aggregated analytics, non-PII logs |
Access control |
L3 |
Confidential |
Email, name, organization data, invoice amounts |
Encryption + access control + audit |
L4 |
Restricted |
PIB/JMBG/OIB/JIB (tax IDs), IBAN, TOTP secrets, password hashes |
Encryption + RBAC + MFA + audit + 11-year retention |
Tax ID types by country:
Serbia: PIB (9 digits), JMBG (13 digits)
BiH: JIB (13 digits)
Croatia: OIB (11 digits)
7. Data Subject Rights Implementation
RightTo |
Endpoint |
SLA |
Exception |
|---|
Access (GDPR Art. 15 / ZZPL Art. 26) |
GET /api/v1/account/data |
30 days |
— |
Rectification (Art. 16) |
PATCH /api/v1/account/profile |
Immediate |
— |
Erasure (Art. 17) |
DELETE /api/v1/account |
30 days |
Financial records retained per law |
Portability (Art. 20) |
GET /api/v1/account/export |
30 days |
— |
Restriction (Art. 18) |
[email protected] |
30 days |
Manual |
Erasure exception: Invoices, expenses, transactions retained 10-11 years (accounting law). Only PII (email, name, password hash) anonymized.
8. Third-Party Data Processors
Processor |
Service |
Region |
DPA Status |
|---|
RailwayCC-01 |
PostgreSQLAES-256-GCM hostingencryption for L4 Restricted fields (PIB, JMBG, OIB, JIB, IBAN) |
EUTechnical |
WestRS, BA, HR |
Planned |
| CC-02 |
Organization-scoped WHERE on all Prisma queries |
Technical |
All |
Planned |
| CC-03 |
RBAC with 4 roles (Frankfurt/Paris)owner/admin/accountant/viewer) |
Technical |
All |
Planned |
| CC-04 |
JWT RS256 with 15min expiry + refresh token rotation |
Technical |
All |
Planned |
| CC-05 |
TLS 1.3 minimum via Cloudflare |
Technical |
All |
Active |
| CC-06 |
LoggedAction audit trail (append-only, 10-11yr retention) |
Technical |
All |
Planned |
| CC-07 |
DPA signed with Railway, Cloudflare, Sentry |
Legal |
All |
Required — sign before pre-launch |
VercelCC-08 |
FrontendSEF hostingintegration for RS B2B e-invoicing |
EU edgeTechnical |
RequiredRS |
P2 Roadmap |
CloudflareCC-09 |
CDN,HR-FISK WAF,integration R2+ storageFINA certificate flow |
EU regionTechnical |
RequiredHR |
P2 Roadmap |
SendGridCC-10 |
TransactionalData emailsubject rights endpoints (/gdpr/export, /gdpr/delete) |
EUTechnical |
All |
Planned |
| CC-11 |
72-hour breach notification procedure to Poverenik/AZLP/AZOP |
Procedural |
All |
Required pre-launch |
| CC-12 |
Privacy Policy in Serbian, Bosnian, Croatian |
Legal |
RS, BA, HR |
Required pre-launch |
| CC-13 |
Terms of Service with data processing consent |
Legal |
All |
Required pre-launch |
| CC-14 |
VAT rate validation per jurisdiction |
Technical |
RS, BA, HR |
Planned |
| CC-15 |
Retention lock preventing deletion of accounting records during mandatory retention period |
Technical |
All |
Planned |
9.5. Compliance Roadmap
gantt
title Bilko Compliance Roadmap
dateFormat YYYY-MM
section Phase 1 — Pre-LaunchMVP (GDPRpre-launch)
baseline)
GDPR/ZZPL
Phase 2 — SerbiaRS Launch
+SEF Croatiae-invoice Launch
integration Serbia:
:
Croatia:
Phase 3 — BiHBA Launch
10. Risk Assessment
Risk |
Likelihood |
Impact |
Mitigation |
|---|
GDPR/ZZPL breach fine |
Low (if compliant) |
High (GDPR €20M / ZZPL RSD 2M) |
Full implementation before first customer |
SEF non-compliance (RS) |
Medium |
High (RSD 2M) |
Phase 24 SEF— integration | HR
Launch
HR-FISK non-compliance+ (HR) | FINA Highcert (ifflow not: integrated) | 2026-10, Critical2026-12
(HR CoA + EUR 500K) | amounts Phase: 22026-10, mandatory | 2026-11
Porezna uprava FinancialPDV dataexport loss | : Low | 2026-10, Critical | 2026-11
30-dayFINA RailwayRGFI backups,export immutable: audit | 2026-10,
2026-11
Tax calculation error |
Low |
High |
Configurable rates, NUMERIC precision, Zod |
BiH CPF delay |
Medium |
Low |
Phase 3 planned, not blocking RS/HR |
Approval
| Role |
Name |
DateSignature |
SignatureDate |
| Author |
DPO / Compliance ArchitectOfficer |
|
2026-02-23 |
|
DPOReviewer (CTO) |
|
|
|
LegalReviewer Counsel(RS Legal) |
|
|
|
CEOReviewer (BA Legal) |
|
|
|
| Reviewer (HR Legal) |
|
|
|
| Approver |
CEO |
|
|
