ZATCA Phase 2 E-Invoicing in Saudi Arabia: Complete 2026 Guide

If you sell anything in the Kingdom of Saudi Arabia, ZATCA Phase 2 is no longer a future problem. By mid-2026 the integration phase has rolled out to businesses well below the SAR 1 million revenue line, and the Zakat, Tax and Customs Authority has shown it will issue fines for non-compliance. This guide cuts through the noise and explains what Phase 2 actually requires, who is in scope right now, and how to integrate without overspending.

A quick recap: Phase 1 vs Phase 2

Saudi Arabia’s e-invoicing programme (Fatoorah) started on 4 December 2021 with Phase 1, the “generation phase”. Phase 1 only required taxpayers to issue tax invoices electronically in a structured format with a QR code, a UUID, and a hash. There was no live connection to ZATCA.

Phase 2, the “integration phase”, began on 1 January 2023 and is different in one fundamental way: every invoice must be transmitted to ZATCA’s Fatoora platform before (or, for B2C, shortly after) it is given to the customer. ZATCA either clears the invoice (B2B) or accepts it as a reported simplified invoice (B2C). Without that clearance stamp and the cryptographic signature, the document is not a legal tax invoice in KSA.

Who is in scope in 2026?

ZATCA has rolled out Phase 2 in waves announced roughly every two to three months. Each wave captures a slice of VAT-registered taxpayers based on their annual taxable revenue for 2021 or 2022. The early waves caught the giants. The later waves — wave 15 onwards — have brought in businesses with revenue as low as SAR 1.5 million, and waves announced through 2025 have pulled in taxpayers above SAR 1 million.

The practical answer for 2026 is simple: if you are VAT-registered in KSA and your annual revenue in any year from 2021 onwards has crossed SAR 1 million, assume you are either already in scope or about to be. ZATCA notifies each taxpayer at least six months before their go-live date, but waiting for the letter is risky — the integration work takes longer than most finance teams expect.

What Phase 2 technically requires

This is where most general-purpose accounting tools fall over. A compliant Phase 2 solution must do all of the following:

• Generate invoices in XML using the ZATCA UBL 2.1 profile, with Arabic mandatory and English optional.
• Onboard each device or e-invoice generation unit (EGS) with ZATCA using a Cryptographic Stamp Identifier (CSID) issued via the Fatoora portal.
• Sign every invoice with the CSID’s private key and embed a cryptographic stamp.
• Clear B2B invoices in real time by submitting them to the Clearance API and waiting for ZATCA’s cleared XML before issuing it to the buyer.
• Report B2C (simplified) invoices to the Reporting API within 24 hours of issuance.
• Embed a TLV-encoded QR code with the seller’s VAT number, timestamp, totals, VAT amount, and the ZATCA hash.
• Maintain a tamper-resistant archive of XML invoices for at least six years.

You also have to support credit notes and debit notes with proper references to the original invoice, and you must handle ZATCA’s rejection responses gracefully — a rejected invoice cannot be reissued under the same UUID.

The five mistakes we see most often

1. Treating Phase 2 as a printing problem. A QR code on a PDF is Phase 1. Phase 2 is an API integration and a PKI exercise.
2. Mixing B2B and B2C flows. B2B invoices need clearance before the customer sees them. B2C invoices are reported after. Using one flow for both will fail audits.
3. Hardcoding the CSID. Certificates rotate. If your system can’t renew the CSID automatically through the Fatoora portal, every renewal becomes a weekend outage.
4. Skipping the sandbox. ZATCA’s sandbox catches dozens of edge cases — rounding, line discounts, exempt items, advance payments — that production will not forgive.
5. Forgetting Arabic. Item descriptions, addresses, and party names must be present in Arabic. English alone is not compliant.

Penalties: what non-compliance actually costs

ZATCA’s fine schedule under Article 45 of the VAT Implementing Regulations is enforced. The headline numbers:

• Failure to issue or archive an e-invoice: between SAR 1,000 and SAR 50,000.
• Failure to include the QR code or required fields on a simplified invoice: warning, then escalating fines.
• Deletion or modification of an e-invoice after issuance: SAR 10,000 to SAR 50,000.
• Failure to notify ZATCA of a system malfunction that prevents invoicing: fines plus the obligation to file manual returns.

ZATCA has signalled a grace approach for first-time, good-faith errors after a taxpayer’s wave goes live, but that grace is finite and not a strategy.

Build, buy, or use what you already have

Three realistic paths:

1. Build it in-house

Doable, but you are now running a PKI service, an XML pipeline, and a real-time integration with a government API. Expect three to six months of work and a permanent maintenance budget. Worth it only if you have unusual workflows the market doesn’t serve.

2. Bolt a middleware on your existing system

Several Saudi vendors sell ZATCA middleware that sits between your accounting software and Fatoora. This works if your current system can export clean invoice data. It does not work if the source data is incomplete — missing Arabic descriptions, wrong VAT category codes, or inconsistent customer IDs.

3. Use an ERP that handles it natively

The cleanest path for small and mid-sized businesses is to use an ERP where Phase 2 is built in, the CSID is managed for you, and the same system handles your accounting, inventory, and VAT returns. This is exactly the gap Naqix ERP was built for — Phase 2 clearance and reporting are native, Arabic is a first-class language, and the same tenant supports your other GCC entities if you have them.

A pragmatic checklist before your go-live date

• Confirm your wave and go-live date in the Fatoora portal.
• Clean up your customer master data — VAT numbers, addresses, Arabic names.
• Decide on B2B vs B2C flows per branch and per channel.
• Run at least 50 sandbox invoices including credit notes and exempt items.
• Onboard every billing device or POS as a separate EGS in production.
• Train cashiers and AR staff on what to do if clearance fails.
• Document your archival policy — storage, retrieval, and audit response.

Phase 2 isn’t about printing invoices anymore. It’s about your accounting system holding a real-time conversation with ZATCA on every transaction. The businesses that treat it that way breeze through audits.

The bottom line

ZATCA Phase 2 has matured from a scramble in 2023 to a stable, well-documented programme in 2026. The taxpayers who are struggling now are almost always the ones still using tools that were designed before Phase 2 existed. If you are anywhere near the revenue threshold, the time to move is before your wave letter arrives — not after.