This article may contain affiliate links. If you purchase through these links, we may earn a commission at no extra cost to you. This helps support our independent reviews.
Phase 1 changed what your invoice looked like. Phase 2 changes who has to see it before your customer does — and that is a systems problem, not a template problem.
ZATCA's e-invoicing programme runs in two phases. Phase 1, the Generation Phase, went live on 4 December 2021 and applied to every VAT-registered business in the Kingdom at once. It required invoices to be produced electronically in a structured system, banned handwritten and word-processed documents, and put a QR code on simplified invoices. It did not require you to connect to anything. Phase 2, the Integration Phase, began on 1 January 2023 and does.
The distinction matters because a great many businesses did the Phase 1 work in 2021, watched a QR code appear on their receipts, and concluded they were finished. They were not. Phase 2 requires the software issuing your invoices — ZATCA calls it an E-Invoice Generation Solution, or EGS — to hold a cryptographic certificate issued by the Authority, sign every document with it, link each document to the one before it, and exchange data with the Fatoora platform over an API. A PDF with a QR code stapled on satisfies none of that.
Phase 2 is also not being switched on for everyone at once. ZATCA is rolling it out in waves, each defined by a revenue threshold, each with its own integration deadline, and each announced in advance. That structure is the single most misunderstood part of the programme, and it is where most of the avoidable panic comes from.
Six things have to be true about a Phase 2 invoice. Miss any one of them and the document is not an invoice — it is a rejection waiting to happen.
ZATCA does not mandate a product. It mandates a specification, published as the E-Invoicing Implementation Resolution and the accompanying detailed technical guidelines, and anything that satisfies it is acceptable. What follows is the practical shape of that specification — the parts that determine whether your file clears or bounces.
The invoice is a structured XML document following UBL 2.1 with ZATCA's Saudi extensions — not a PDF, not an image, not a spreadsheet export. Standard tax invoices are exchanged as XML. Simplified invoices are issued as PDF/A-3 with the XML embedded inside the file, so the machine-readable copy travels with the human-readable one.
Every EGS unit — every till, every branch server, every instance of your billing software — holds its own certificate issued by ZATCA and signs the documents it produces with it. The certificate is what proves the invoice came from a registered device belonging to your VAT registration. It is device-specific, not company-wide, which is why your device count drives your onboarding effort.
Each document carries a UUID that is separate from your own human-readable invoice number. Your commercial sequence can restart, be prefixed by branch or be reset at year end; the UUID cannot collide with anything you have ever issued, which is what lets ZATCA identify a document unambiguously across millions of taxpayers.
Each invoice stores the SHA-256 hash of the previous invoice's XML, so your documents form a tamper-evident chain. The first one uses a fixed base value that ZATCA specifies. Break a link and every subsequent submission on that chain is rejected until the chain is repaired — and the repair means recomputing from what ZATCA actually cleared, not from your local cache.
Alongside the hash sits a counter that must increment by exactly one, per EGS unit, with no gaps and no reuse. Credit and debit notes take their own place in that sequence — you cannot slot a correction in beside the document it corrects, however logical that feels from an accounting point of view.
Phase 2 QR codes are not the Phase 1 ones. They encode the seller name, VAT number, timestamp, invoice total, VAT total, the XML hash, the cryptographic signature and the public key in tag-length-value format, so that a scanner can verify the invoice independently without asking your system anything at all.
The reason to understand these six rather than delegate them wholesale is diagnostic. When ZATCA rejects a submission, the error refers to one of them. A vendor who tells you 'the API is down' when the real problem is a counter gap on till three costs you a day of invoicing. Knowing which layer failed is the difference between a fifteen-minute fix and a week of support tickets.
There is also an archiving obligation attached to all of this that buyers routinely overlook. Invoices and their associated notes must be retained in structured, readable form and stored on infrastructure inside the Kingdom. The figure most commonly cited is a six-year minimum, with longer periods for certain categories such as real estate — retention varies by document type, so confirm yours against ZATCA's own guidance rather than a summary table. If you are evaluating a cloud vendor, ask where the data physically sits and get the answer written into the contract, not the sales deck.
Phase 2 imposes two different flows depending on who the invoice is for, and conflating them is one of the more expensive mistakes a Saudi business can make.
A standard tax invoice — the B2B or B2G document, the one carrying the buyer's VAT registration number — must be cleared. Your system sends the signed XML to ZATCA, ZATCA validates it, and only when it comes back cleared and stamped by the Authority is the invoice legally valid. Until then you cannot send it to your customer. Not 'should not' — cannot. The document has no legal standing.
A simplified tax invoice — the B2C receipt handed across a counter — works the other way round. You issue it immediately, the customer walks away with it, and your system reports it to ZATCA within 24 hours. That asymmetry exists for an obvious operational reason: nobody is going to stand at a till waiting for an API round trip. It also means a retail system needs to buffer and retry, because the 24-hour clock does not care that your connection dropped at 6pm on a Thursday.
The wave you belong to is decided by your VAT-able revenue in specific past years — not by what you are turning over today, and not by how big you feel.
Each wave announcement names a threshold and the years it is measured against. Wave 24 covered taxpayers whose VAT-subject revenues exceeded SAR 375,000 in 2022, 2023 or 2024, with an integration deadline of 30 June 2026. Wave 25, published on 24 July 2026, covers taxpayers above SAR 187,500 in 2022, 2023, 2024 or 2025, with a deadline of 1 February 2027. Note the 'or': crossing the threshold in any one of the named years puts you in the wave, even if you have shrunk since.
ZATCA notifies the taxpayers it selects directly, and the announcements have consistently landed months ahead of the deadline — Wave 25 was published a little over six months before its date. That is an observed pattern rather than a published guarantee, so treat the notification as a confirmation and not as your early-warning system. If you are anywhere near a threshold, assume you are in the next wave and plan on that basis.
The direction of travel is not subtle. Wave 1, in January 2023, applied only to taxpayers above SAR 3 billion. Wave 23 closed at SAR 750,000 in March 2026, Wave 24 halved that to SAR 375,000, and Wave 25 halved it again to SAR 187,500. At that rate the population of VAT-registered businesses still outside Phase 2 is small and shrinking. Planning on the assumption that you will never be in scope is not a strategy.
One practical instruction, and it is the most important sentence in this guide: confirm your wave and your deadline on ZATCA's own portal, or in the notification you receive from ZATCA. Thresholds, dates and criteria change, secondary sources go stale within months — comparison articles very much included, this one among them — and the only version that binds you is the Authority's.
Connecting a system is a fixed sequence of five steps. Each has a specific way of going wrong, and every one of those ways is avoidable if you know about it in advance.
Your system generates a key pair and a certificate signing request carrying your VAT registration number, commercial registration, organisation unit, the EGS unit's serial number and the invoice types it will issue. Every field is cross-checked against what ZATCA already holds. A mismatch here — a stale CR number, a company name that differs from the register — is rejected at the certificate authority, long before any invoice is involved.
You log into the Fatoora portal, generate a one-time password and hand it to your software to complete the pairing. The OTP has a short life — commonly reported as one hour — and this is the single most frequent point of failure, because teams generate it and then stop to chase an IT approval or hunt for a document. Assemble everything first, then open the portal.
ZATCA issues a compliance certificate scoped to testing. This is not a licence to invoice. It is the credential you use to prove that your system can produce documents which pass validation, and it exists precisely so that your mistakes happen somewhere harmless.
Your system submits a fixed battery of sample documents — standard invoices, simplified invoices, credit notes, debit notes, and variations covering zero-rated lines, mixed tax rates and foreign currency. The exact set depends on which invoice types you declared in the request. Anything that fails here becomes a hard rejection in production, so this is the stage to be pedantic rather than fast.
Once the checks pass you request the live certificate and begin clearing real invoices. It is valid for one year and it does not renew itself. Put the expiry in a calendar owned by a named person, not in a vendor's roadmap, because an expired certificate stops invoicing on an ordinary Tuesday morning with no warning whatsoever.
ZATCA publishes a sandbox and a simulation environment alongside the production platform, together with an SDK and a web-based validator. Any vendor worth the contract will have run your specific configuration through simulation before touching production. Ask them to show you the simulation results rather than accepting a verbal assurance that everything is fine.
The certificate is bound to a device, and a compromised private key means revocation — permanent, with a fresh certificate request and a full onboarding cycle behind it. That is worth understanding before somebody copies a production key onto a test laptop to 'check something quickly'.
Most Saudi businesses will meet Phase 2 by buying compliant software rather than building an integration. The buying question is narrower than vendors like to make it.
Appearing among ZATCA's qualified solution providers is a useful filter, not a guarantee that covers your configuration. The directory tells you a product has been through the process; it does not tell you that your branches, your invoice types and your device count are included in the plan you are being quoted. Ask about those specifically, and get the answer in the quote.
The structural question is whether clearance happens inside the product or through a bolted-on middleware layer. Both can work. Only one of them has a single owner when it breaks at month end, and only one of them avoids a separate annual integration fee that nobody costed into the original comparison.
These are the failure modes that recur — not because the specification is unreasonable, but because the details are unforgiving and most of them only surface in production, on a day when you are busy.
The pairing password issued from the Fatoora portal is short-lived, and the onboarding sequence is not something you can pause halfway through. Teams routinely generate an OTP, discover they need a CR document or an IT sign-off, and return to a dead credential. Gather every document and permission first, then open the portal.
The signing request carries identity fields that ZATCA cross-references against its own records. A VAT number typo, an organisation name that differs from the commercial register, or a common name that does not match will be rejected outright — and the error message is rarely as specific as you would like it to be.
Each invoice carries the hash of the one before it. Restore a database from a backup, run a test batch against production, or resolve the 'previous' document wrongly in a multi-branch setup, and the chain breaks. Everything after that point is rejected until it is repaired, and the repair means recomputing from what ZATCA actually cleared rather than trusting your own records.
The invoice counter must increment by one per EGS unit, with no gaps and no reuse. Voided documents, parallel test environments and an over-helpful developer who 'fixed' a number by hand all produce gaps. So does a correction note slotted in beside its original instead of taking its own place at the end of the sequence.
Production certificates are valid for a year and do not renew themselves. There is no grace period built into the file. The failure is entirely silent until the morning invoicing stops, and it is entirely avoidable with a calendar entry and a named owner — which is why it is so irritating when it happens.
Each VAT registration keeps its own independent chain and its own counter. Groups running several entities on one platform occasionally end up sharing state between them, which invalidates both chains at once. If you operate more than one registration, confirm the separation explicitly rather than assuming the software handles it correctly.
Phase 2 has been rolled out in successive waves since January 2023, each one lowering the revenue threshold. The table below summarises the published pattern. It is not a substitute for your own notification — verify your wave with ZATCA before you plan around any date on this page.
| Wave | VAT-able revenue | Integration deadline | Status |
|---|---|---|---|
| Waves 1–9 | Above SAR 30 million | Staged from 1 January 2023 | Closed |
| Waves 10–22 | SAR 1 million to SAR 30 million | Staged to 31 December 2025 | Closed |
| Wave 23 | Above SAR 750,000 | 31 March 2026 | Closed |
| Wave 24 | Above SAR 375,000 | 30 June 2026 | Closed |
| Wave 25 | Above SAR 187,500 | 1 February 2027 | Open |
Two things stand out. The first is the compression: it took nine waves to work down from SAR 3 billion to SAR 30 million, thirteen more to reach SAR 1 million, and then the last three roughly halved the threshold each time within the space of a year. The second is that there is no announced Wave 26 as we publish this. That is not evidence the programme has stopped — only that the announcement has not happened yet.
If your revenue sits below SAR 187,500 today, you are outside the announced scope and squarely inside the obvious trajectory. The cost of preparing early is a software decision you were probably going to make anyway. The cost of preparing late is running an onboarding, a data migration and a round of staff retraining inside a compressed window — which is exactly when the failure modes in the previous section start to bite.
This is not a full comparison — we have one of those elsewhere. It is a short list of platforms that carry clearance and reporting inside the product rather than through a separate connector, to give you somewhere to start a shortlist. Prices move constantly in this market; take these as an indication and confirm with the vendor on the day you buy.
| Platform | Best for | Integration route | Entry price |
|---|---|---|---|
| Wafeq | Services firms and agencies wanting the cleanest bilingual interface | Native Fatoora integration | From around SAR 99/month |
| Qoyod | Saudi SMEs needing Arabic-first accounting with inventory and POS | Native, Phase 2 certified | From SAR 138/month incl. VAT |
| Zoho Books (KSA) | Multi-entity or multi-currency SMEs on a tight budget | Native from the paid tiers | From around SAR 60/month |
| Odoo Enterprise | Operations that have outgrown a SaaS accounting suite | Native in Enterprise via the KSA localisation module | Per user, plus implementation |
A modern bilingual accounting platform built for the KSA and UAE market, with clearance and reporting handled inside the product and a documented API for anything you need to wire around it.
The most comfortable option if your team works across Arabic and English and your invoicing is professional-services shaped rather than retail.
A Saudi-built accounting platform certified for Phase 2, which generates the XML, signs it, submits it to Fatoora and returns a PDF/A-3 with the XML embedded — with no middleware anywhere in the path.
A strong fit for Saudi SMEs that also need inventory or point of sale, provided you model the add-on pricing rather than the headline plan.
The Saudi edition of Zoho's accounting product, with Phase 2 support from the paid tiers and the depth of a very large global suite sitting behind it.
The value option, and the sensible one if you run more than one entity or currency — with the caveat that the Arabic interface trails the locally built products.
Your Next MovesCompliance work fails for scheduling reasons far more often than technical ones. This is the sequence that keeps it boring, which is the only state a tax integration should ever be in.
Log into the Fatoora portal and check whether you have been notified, and for which deadline. Do not take a date from a table, ours included. If you are close to the current threshold in any of the qualifying years, plan as though you are already in the next wave.
Count your invoice types, your branches and your devices. Standard and simplified invoices carry different obligations, and every till is a separate EGS unit with its own certificate and its own counter. That number drives both your quote and your onboarding effort more than anything else does.
Run the full battery of sample documents through ZATCA's simulation environment and read the results yourself rather than taking a summary. Every failure fixed there is a failure that never reaches a customer invoice. Only then request the production certificate.
Production certificates expire after a year, chains break after restores, and counters gap after test batches. Name a person responsible for the renewal date and for reviewing rejections weekly. This is the cheapest part of the entire programme and the part most often skipped.
The honest summary is that Phase 2 is demanding but not ambiguous. The specification is published, the failure modes are well documented, the sandbox costs nothing, and the deadlines are announced in advance. What catches businesses out is almost never complexity — it is starting in the last fortnight, with an OTP that expired while somebody went looking for the commercial registration certificate.
Quite possibly. Wave 25, announced on 24 July 2026, covers taxpayers whose VAT-subject revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025, with an integration deadline of 1 February 2027. Crossing the threshold in any one of those years is enough, even if you are smaller now. Check your own status on the Fatoora portal rather than inferring it from a revenue figure.
Phase 1, from December 2021, required invoices to be generated electronically in a structured system and put a QR code on simplified invoices. Phase 2, from January 2023, requires your system to hold a ZATCA-issued certificate, sign each invoice, chain it to the previous one and exchange data with the Fatoora platform over an API. Passing Phase 1 tells you essentially nothing about Phase 2 readiness.
Yes. Standard tax invoices are cleared, meaning ZATCA validates and stamps the document before it is legally valid and before you may send it to the buyer. Simplified B2C invoices work differently: you issue them immediately at the point of sale and report them to ZATCA within 24 hours.
ZATCA publishes a schedule of violations and fines, but the figures reported by secondary sources differ meaningfully — an older ladder is still widely quoted alongside a newer classification that begins with a warning and a correction window before escalating on repeat offences. We are not going to print a number we cannot stand behind, so read ZATCA's current violations guideline directly. In practice the larger cost is usually cash flow rather than the fine, because an uncleared B2B invoice cannot legally be sent, so the receivable never starts ageing.
ZATCA extended its cancellation of fines and exemption of financial penalties initiative through 31 December 2026. It covers matters such as late registration, late filing, late payment and return corrections, subject to conditions, and excludes tax evasion and fines already paid. Whether e-invoicing field-detection fines fall inside the current extension is not something we could confirm from the announcement text, so verify the scope with the Authority before relying on it.
Get weekly expert recommendations, honest comparisons, and exclusive guides — tailored for the Middle East market.
