SAF-T: When the State Demands the Keys to the Safe, the Accounting Records, and the Business The Beginning of the End for the Market Economy?

Zhechko Dimitrov (SFB Capital market JSC)

SAF-T: When the State Demands the Keys to the Safe, the Accounting Records, and the Business

The Beginning of the End for the Market Economy?

As of January 1, 2026, Bulgaria has begun implementing SAF-T—a standardized electronic format through which certain enterprises submit accounting data to the National Revenue Agency (NRA). Initially, the regime covers the largest enterprises, with a phased rollout planned. At first glance, this sounds like yet another administrative modernization: more electronic data, more automation, and fewer paper-based audits. Yet, behind this seemingly technical reform lies a far more significant question:

How much information about a private business should the state possess in order to collect its taxes?

And an even more critical question:

Can we demand that private businesses provide vast amounts of sensitive information when the state itself has proven fallible in safeguarding the data it holds?

From Tax Oversight to Constant Surveillance

No reasonable person would dispute the necessity of tax oversight. The state has the right to verify whether enterprises are correctly declaring their revenue, paying their taxes, and complying with the law. However, there is a fundamental difference between "The state has the right to audit my accounts" and "The state receives a systematized, structured stream of my accounting data."

SAF-T represents a shift precisely toward the latter model. The NRA itself states that the system is designed to enable the receipt and analysis of accounting information in a unified format. This alters the fundamental nature of the relationship between the state and the business sector. Instead of the state stepping in only when there are grounds for an inspection, an infrastructure is gradually being built where businesses must constantly prepare their information in a format that allows for machine processing by the state. This is not merely an accounting change; it is a shift in the model of state oversight.

And who pays for this "digitalization"?

Businesses do, of course—not the state.

Enterprises must adapt their accounting software, structure their data, perform checks, resolve discrepancies, and ensure the technical capability to submit the information:

For large companies, this can mean significant IT costs.

For accounting firms, it means more work.

For the clients of accounting firms, it means higher costs.

This is particularly problematic because administrative burdens do not, in themselves, create a single product, service, or job.

They represent a cost passed on to the real economy.

The most serious issue: security.

This is where the conversation becomes much more serious.

In 2019, the National Revenue Agency (NRA) fell victim to a massive cyberattack that resulted in the unauthorized disclosure of personal data and tax and social security information. The NRA itself acknowledged the unauthorized data leak. The incident involved information concerning millions of citizens and companies. It was described as unprecedented in scale, and the NRA was fined BGN 5.1 million for violations related to data protection measures. Legal proceedings regarding the sanction eventually concluded due to the expiration of the statute of limitations; however, the breach itself and the established data protection violations remain part of the publicly documented history of the case.

This case does not prove that the National Revenue Agency (NRA) will inevitably suffer another corporate data leak. Yet, it demonstrates something far simpler and far more important: the state information system is not impenetrable.

Consequently, every additional set of sensitive data concentrated within it creates additional risk. And corporate information is often far more sensitive than a mere tax identifier. It can reveal:

● a company’s key clients;

● its main suppliers;

● turnover volume and structure;

● pricing arrangements;

● business models;

● payments;

● liabilities;

● business dependencies;

● cost structures;

● economic relationships between related parties.

This is information that can hold genuine competitive value.

Trade secrets are not a tax issue

Two entirely legitimate public objectives clash here:

On the one hand, the state seeks effective tax collection. On the other, a market economy presupposes that private enterprises can safeguard their business relationships, strategies, and competitive advantages.

When the state amasses vast quantities of information about the private sector, the question of proportionality arises: Does the state have the right to monitor business? And is this specific information—in this specific volume, frequency, and format—actually necessary?

This is the crucial democratic debate that is currently missing.

There is also another risk: concentration.

In information security, there is a simple principle: the more valuable a dataset is, the more attractive a target it becomes. If data concerning a large part of the economy gradually becomes concentrated in a single system, that system becomes a highly valuable target for hackers, organized crime, malicious insiders, industrial espionage, and even future forms of misuse that we cannot currently foresee.

The question is not merely whether the NRA (National Revenue Agency) has good intentions, but whether society should concentrate such vast information-gathering power in a single place.

A market economy means more than just low taxes.

A market economy relies on another fundamental condition: that the state does not know everything about every economic participant. Entrepreneurs need space to make decisions, negotiate, experiment, and build a competitive advantage. If the state gradually gains a detailed picture of all economic interactions, the line between tax oversight and economic surveillance begins to blur. Today, this might be justified by the fight against tax fraud. Tomorrow, the same infrastructure could be used for other purposes. And after some time, society might forget that a different boundary ever existed—and that is precisely what should concern us.

The problem is not the technology itself.

SAF-T is not inherently bad simply because it is digital. E-government is necessary, as is the automation of administrative processes.

The problem arises when technological capability is used as a pretext for collecting more information than is necessary. Technology should serve citizens and businesses, not force businesses to build infrastructure that grants the state increasingly comprehensive access to their economic activities.

There is a sensible alternative approach.

Effective tax oversight is possible without the state obtaining the maximum possible volume of information—for instance, through data minimization and clearly defined purposes for data usage. strict access controls; automatic deletion or archiving after a set period; independent information security audits; traceability regarding which employee accessed specific data; severe personal sanctions for misuse; regular public reporting on security incidents; and, above all, a requirement for the state to justify the necessity of every specific type of data it requests.

This is the principle of proportionality.

The question we must as:

We should not uncritically accept every new administrative system simply because it is presented as "European," "digital," or "modern." The state has the right to collect taxes. However, it does not have an automatic right to collect everything it is technically capable of obtaining. Businesses are not state property. Accounting records are not a public register, and an accountant is not a tax agent. Commercial information is not state property.

And if the state wishes to acquire vast amounts of such data, it must offer more than just the argument: "This makes it easier for us to exercise control."

For administrative convenience alone cannot justify restricting economic autonomy or increasing the risk to trade secrets.

Is this the beginning of the end?

In its current form and scope, SAF-T marks the beginning of the end for the market economy; precisely for this reason, this dangerous trend must become a subject of public debate. Because any system that begins with "Give us information so we can control you more effectively" must be followed by a second question: "And who will control the one who controls everyone else?"

That is precisely where the real conversation about the free market, state power, and the limits of digital control begins.

 

Business - all analyses

Archive
Business Industry Capital

Commentary column