ZATCA Phase 2 e-invoicing: what your ordering or billing system needs before 1 February 2027
Updated · KBLabs
Wave 25, announced by ZATCA on 24 July 2026, covers every taxpayer whose VAT-able revenue exceeded SAR 187,500 in any of 2022, 2023, 2024 or 2025 — the lowest threshold of the rollout so far. Integration with ZATCA’s platform (Fatoora) is due by 1 February 2027. If your platform issues invoices in Saudi Arabia, it has to issue them the Phase 2 way.
What changes from Phase 1
Phase 1 asked businesses to generate electronic invoices with a QR code carrying five fields: seller name, VAT number, timestamp, invoice total and VAT amount. Phase 2 connects your system to ZATCA. Invoices are produced as structured XML, cryptographically stamped, and either cleared or reported through Fatoora — and the QR code grows to nine fields, including the invoice hash, your signature and your public key.
| Standard (B2B) invoice | Simplified (B2C) invoice | |
|---|---|---|
| When ZATCA sees it | Cleared before the buyer receives it | Reported after it is issued, within 24 hours |
| What that means for your flow | The invoice isn’t final until ZATCA returns it | The sale can complete first; reporting follows |
What your system has to do
- Onboard each invoicing unit: generate a key pair and a signing request, get a compliance certificate, pass ZATCA’s compliance checks, then exchange it for a production certificate.
- Produce each invoice, credit note and debit note as UBL 2.1 XML.
- Hash and sign every invoice, and chain them: each carries a strictly increasing counter and the previous invoice’s hash, so a deleted invoice is detectable.
- Clear standard invoices before they reach the buyer; report simplified invoices within 24 hours.
- Print or show the nine-field QR code on every invoice.
- Handle rejections and warnings from ZATCA, retry safely, and keep an audit trail.
- Renew certificates before they expire.
Where integrations go wrong
- Invoices created in more than one place — the ordering app, a POS, the ERP. The invoice chain needs one source of truth, so decide which system issues invoices before writing code.
- Offline sales-rep apps. A simplified invoice can be issued offline and reported once the device reconnects, as long as the chain stays intact. A standard B2B invoice can’t be handed to the buyer until it is cleared, so offline B2B flows need a different design.
- Clearance in the checkout path. B2B clearance is a live call to ZATCA; the ordering flow has to cope when it is slow or rejects an invoice.
- Leaving the sandbox too late. Onboarding and compliance checks take time — start them early, not in the last month.
Build it, or integrate through your ERP?
If your ERP or accounting system is already certified for Phase 2 and every invoice passes through it, integrate your platform with it rather than re-implementing the rules. Build the integration directly when invoices originate in your own platform — a B2B ordering system, for example — and routing them through the ERP isn’t practical. Either way, map it in discovery: which system issues, which system stores, and what happens when ZATCA says no.
This is a technical summary, not tax advice. Confirm your wave, deadline and obligations with ZATCA or your tax adviser.
Common questions
- Am I in Wave 25?
- If your VAT-able revenue exceeded SAR 187,500 in any of 2022, 2023, 2024 or 2025 and you weren’t in an earlier wave, ZATCA’s criteria put you in Wave 25, with integration due by 1 February 2027. ZATCA notifies targeted taxpayers; confirm with them or your tax adviser.
- Can a mobile sales app issue invoices offline?
- Simplified (B2C) invoices, yes — they are reported within 24 hours, so they can be issued offline and reported on reconnect if the invoice chain stays intact. Standard (B2B) invoices must be cleared before the buyer receives them, so an offline B2B flow needs a different design.
- Is a QR code generator enough?
- No. Four of the nine Phase 2 QR fields — the invoice hash, the signature, the public key and the certificate stamp — can only come from the system that signs the invoice. A code generated separately won’t match a compliant invoice.