ZATCA Phase 2 integration for the system you already run

E-invoicing is enforced by the Zakat, Tax and Customs Authority (ZATCA) in two phases. Phase 1, the Generation phase, became enforceable on 4 December 2021 for all taxpayers except non-residents. Phase 2, the Integration phase, started on 1 January 2023 and is rolled out in waves by taxpayer group1. In Phase 2 it is no longer enough for your system to produce an electronic invoice: the system must be integrated with ZATCA’s systems2.

ZATCA’s detailed guidelines split integration into two tracks by invoice type3:

• Tax invoices (usually B2B): your system sends the invoice as XML to the FATOORA platform through an API for clearance. FATOORA validates it, adds the cryptographic stamp and a QR code, and sends it back cleared. The guidelines make clearance a prerequisite for sharing the invoice with the buyer, with exceptions they set out for when the platform cannot be reached3.
• Simplified tax invoices (usually B2C): your system stamps the XML itself with a cryptographic stamp identifier (CSID) issued by ZATCA, adds a QR code in the required format, gives the buyer a copy at once, and then reports it to FATOORA within 24 hours of generating it3.
• Clearance does not apply to simplified invoices. Invoices may be generated as XML or as PDF/A-3 with the XML embedded, but only XML is submitted to FATOORA3.
• The e-invoice generation solution (EGS) has to be onboarded with ZATCA before it sends anything3.

ZATCA says it will notify taxpayers of their Phase 2 wave at least six months in advance1. You don’t have to guess the date: the notice arrives and the clock starts from it. ZATCA sets the waves itself, by the taxpayer groups it announces on its roll-out page1.

You may not be waiting for a notice at all. The roll-out page says the deadline for waves 1 to 9 has passed and every taxpayer in them must already be integrated, and the latest wave it listed when we read it is wave 25: annual revenues subject to VAT above SAR 187,500, with an integration deadline of 1 February 2027, and more waves to be announced1. If your notice has arrived or your deadline has passed, the steps below are the same, fitted to the time you have left rather than six months.

Six months is comfortable if you start early and tight if you wait. This is the plan we suggest from the day the notice arrives:

1. Month 1: list every place your system issues an invoice, a credit note or a debit note, and mark each as a tax or a simplified invoice.
2. Month 2: compare your invoice data with the required fields and list what’s missing (buyer details, tax category codes, numbering, the previous invoice hash).
3. Month 3: build the integration layer: XML generation, stamping, the QR code, submission for clearance or reporting, and a log of every FATOORA response.
4. Month 4: test the invoices and fix every error, then you onboard your system on FATOORA from your own ZATCA account, with us guiding each step.
5. Month 5: a pilot on a limited number of real invoices, with daily checks on anything rejected or delayed.
6. Month 6: full go-live before the deadline, and a short handover so the accounts team can read each invoice’s status.

We don’t touch your sales or stock logic. We add a small layer beside your system that takes each invoice once it’s issued, does what Phase 2 requires, and hands the result back: cleared with ZATCA’s stamp, reported, or rejected with the reason.

1. Your system issues the invoice
2. Convert to XML
3. Stamp and QR
4. Clear or report
5. Store the response, show the status

• Onboarding of the EGS with FATOORA, managing and renewing the stamp identifiers (CSIDs), and keeping the keys somewhere only the system can reach.
• Retries: when FATOORA doesn’t answer, the layer retries at intervals and keeps evidence of each attempt, as the guidelines ask3.
• A status screen for the accounts team: every invoice, its state and the reason for any rejection, instead of digging through logs.
• Archiving of the invoices and FATOORA’s responses exactly as they were.

• ZATCA’s notice, if it has arrived, and its date, so we can count the time left before your wave.
• A sample of every invoice type your system issues: tax, simplified, credit note and debit note, with customer data you don’t need to share removed.
• Access to the invoice data once issued: the database, export files or an API, and the person on your team who knows the system from the inside.
• Your VAT registration details for the entity and its branches, and how many devices or points of sale issue invoices.
• Someone from the accounts team to review the test results with us and sign off the go-live.

If the original developer of your system is still around, that saves time; if not, we read the system and work from its data directly.

Invoices carry customer names, VAT numbers and addresses, and some of that is personal data. The integration layer runs on hosting you own, which can be inside the Kingdom, and we set it up for you. If any service abroad is involved, sending personal data outside Saudi Arabia is governed by Article 29 of the Personal Data Protection Law, which among other conditions limits it to the minimum personal data needed5; SDAIA’s transfer regulation sets out the detail4. Submissions to FATOORA itself go to a Saudi government authority.