E-invoicing software: Phase 2 requirements and integration with Fatoora

E-invoicing software for Phase 2 must produce invoices in XML, stamp and chain every document, and connect to ZATCA's Fatoora platform by API: standard invoices are cleared before they reach the buyer, simplified ones reported within 24 hours. ZATCA rolls Phase 2 out in waves; Wave 25 reaches businesses above SAR 187,500.

This guide covers the software side: what a Phase 2 solution must do, how waves and deadlines work, how onboarding with Fatoora runs, and how to choose a system. Every rule and date below was checked on zatca.gov.sa on 14 October 2026. It is general information, not tax or legal advice; for your own case, follow ZATCA's notification to you or ask a licensed advisor.

What Phase 2 of e-invoicing requires

Saudi e-invoicing has two phases. Phase 1, the Generation Phase, has applied since 4 December 2021: taxpayers must generate and store tax invoices and notes in an electronic solution that meets Phase 1 requirements. Phase 2, the Integration Phase, began on 1 January 2023 and is rolled out in waves by taxpayer group [1].

Phase 2 adds three things, in ZATCA's words: integrating your e-invoicing solution with its Fatoora platform, issuing e-invoices in a specific format, and including additional fields in the invoice [5]. In practice, two flows replace "print and hand over":

• Clearance for standard tax invoices (usually business to business). Your system sends each invoice to Fatoora before sharing it; ZATCA validates it, adds its cryptographic stamp and QR code, and returns the cleared invoice for you to send to the buyer [3].
• Reporting for simplified tax invoices (usually business to consumer). Your system stamps the invoice itself, gives it to the customer, and uploads it to Fatoora within 24 hours of issue [2][3].

ZATCA's detailed guideline compares the two phases requirement by requirement [3]:

Phase 2 waves and timelines, checked 14 October 2026

ZATCA selects each wave by VAT-subject revenue in reference years, and notifies taxpayers at least six months before their integration date [1][2]. ZATCA's roll-out page presents its wave table as an image, so the rows below come from ZATCA's individual announcements.

Three points help you read the table:

• Any one year is enough. If your revenue crossed the threshold in any listed reference year, you are in that wave, even if it fell later [6][10].
• Wave 25 is the latest announced. ZATCA published it on 24 July 2026, and no later wave appeared in its news list when we checked on 14 October 2026 [10].
• Until your date, Phase 1 applies. A taxpayer keeps following Phase 1 requirements until its wave's integration date [3]. Your actual date is the one in ZATCA's notification to you, not a press release.

What e-invoicing software must do in Phase 2

ZATCA's e-invoicing resolution (the controls and technical specifications) and its detailed guideline set out what a compliant solution must do [2][3]. Use this as the requirements list for any system you buy or build.

Format and content

• Generate invoices and credit and debit notes as XML following ZATCA's XML Implementation Standard, which is based on UBL 2.1 [2][4].
• Produce a human-readable version: PDF/A-3 with the XML embedded for standard invoices, and a printout or agreed electronic copy for simplified ones [2][3].
• Carry every mandatory field in Annex 2 of the resolution, and pass the business rules attached to conditional fields [2].

Security and integrity

• Give each invoice a UUID and increment a tamper-resistant counter for every invoice and note [2].
• Link each invoice to the previous one by placing the previous invoice's hash in it, so the chain cannot be reordered [3].
• For simplified invoices, hold a cryptographic stamp identifier (CSID) issued through ZATCA's portal, and generate a stamping key that cannot be exported, protected by disk encryption when stored in software [2].
• Print a QR code: for simplified invoices in Phase 2 it carries nine fields, from the seller's name and VAT number to the hash, the signature and the public key [2][3].

Connectivity

• Connect over an encrypted, authenticated channel such as TLS [2].
• Submit standard invoices in real time and receive ZATCA's response; upload simplified invoices in batches [2].
• Keep working offline: queue invoices and report them once the connection returns [2].

Prohibited functions

ZATCA treats a solution with any of these enabled as non-compliant [2][3]:

To "cancel" an invoice, the solution must issue a credit note and a new invoice; deleting is not an option [3].

How integration with Fatoora works, step by step

Fatoora is not where you write invoices. It is ZATCA's portal for onboarding your e-invoicing units and receiving invoice data; the invoices themselves still come from your own solution [3]. Onboarding links each unit, such as a cash register or an accounting system, to your VAT account. ZATCA's guides describe the steps [3][11]:

1. ZATCA notifies you of your wave and integration date.
2. Log in to the Fatoora portal (fatoora.zatca.gov.sa) with your ERAD credentials, the same account you use for ZATCA's e-services.
3. Choose "onboard a device" for each unit that issues invoices.
4. Generate a one-time password (OTP) for that unit.
5. Enter the OTP in your e-invoicing solution to complete the onboarding of that unit.
6. Check in the portal that the unit shows as onboarded, then start issuing Phase 2 invoices.

The same portal lets you renew or revoke a unit's stamp identifier and see every onboarded solution and device [3]. A new branch or a replacement till is a new unit, so build onboarding into your branch-opening checklist.

Before go-live, developers can test against ZATCA's sandbox through the e-invoicing developer portal [12]. ZATCA describes its toolkit as a sandbox, an SDK and a web-based validator for checking that a solution produces compliant invoices [3].

Clearance and reporting in daily use

Fatoora answers every submission. ZATCA's guideline sets out what to do with each outcome [3]:

ZATCA runs a failure-notification service for incidents that stop you generating or integrating e-invoices. You report the incident, report again when it is fixed, then promptly issue and integrate the invoices for sales made during the outage [13][2]. For simplified invoices, the 24-hour reporting window is the line to watch: if you cannot report within it, ZATCA's guideline expects you to notify it through that form [3].

Choosing Phase 2 e-invoicing software: a buyer's checklist

ZATCA publishes a Solution Providers Directory of companies that have passed its qualification process for Phase 1 or Phase 2. ZATCA calls it an indicative, non-binding list, says it is not an approval of any solution, and states that you are compliant with any solution that meets the requirements, even if its provider is not listed [14]. Treat the directory as a starting point, then test.

Ask every candidate, in writing:

1. Phase 2 status. Has the solution completed ZATCA's qualification for Phase 2, and can you see it onboarded in a sandbox?
2. Both flows. Does it clear standard invoices in real time and report simplified invoices within 24 hours, including credit and debit notes?
3. Units and branches. How are tills, branches and users onboarded, and how is each unit's single sequence kept?
4. Offline behaviour. What happens to sales when the internet drops, and how are queued invoices reported?
5. Warnings and rejections. Who sees Fatoora's responses, and who fixes recurring warnings?
6. Arabic output. Is every visible field in Arabic, with English only as a translation?
7. Special cases you need. Advance-payment invoices and their later adjustment, exports, zero-rated and exempt lines, summary invoices [3].
8. Archive and exit. Can you export all XML and PDF/A-3 files under ZATCA's naming rule (VAT number, issue date, time and invoice number) if you leave [2]?
9. Hosting. Where are invoices stored, and can ZATCA reach them for audit? ZATCA's guideline allows cloud hosting provided the data is accessible to it through a direct link [3].
10. Stamp identifier care. How are CSIDs renewed, and who in your company is alerted before one expires?

Our guide to choosing a software company in Saudi Arabia gives a way to score vendors' written answers before you compare prices.

Is there free e-invoicing software for Phase 2?

None of the ZATCA pages we checked on 14 October 2026 offers ready-made invoicing software for businesses. What ZATCA does publish are the specifications, the developer portal and sandbox, the Solution Providers Directory and the VAT app that reads QR codes [3][12][14]. ZATCA also confirms that a cloud system is not required: any invoicing system is acceptable if it meets the requirements [15].

If a provider offers a free plan, check it against the same list as a paid one. Free tiers often limit the number of invoices, users or devices, and the limits matter once each till needs its own onboarding. Confirm in writing that the free plan covers both clearance and reporting, credit notes, and a full XML export of your archive, since you must keep invoices for years after the plan or the provider changes.

Mistakes that break compliance after go-live

• Sharing a standard invoice before clearance. In Phase 2, clearance is a precondition for the invoice to be valid and shared [3].
• Deleting or editing an issued invoice instead of issuing a credit note [3].
• Missing the 24-hour reporting window for simplified invoices without notifying ZATCA [3].
• Issuing from a unit that was never onboarded, such as a new branch till [2].
• Changing the device's date or time, or resetting an invoice counter [2].
• Ignoring repeated warnings. ZATCA says continuous warnings will be investigated [3].

The resolution states that the penalties in the VAT Law apply to violations of the e-invoicing rules, according to the violation classifications set by ZATCA's board [2].

Your next step

Find ZATCA's notification for your wave, or check your revenue against the thresholds above. Then list every unit that issues invoices today (tills, branch systems, the accounting package), ask your provider the ten checklist questions, and book a sandbox test before your integration date. If your e-invoicing software has to talk to an ERP or other systems you run, our guide to custom software development in Saudi Arabia explains when to connect and when to build. O AI is a software and AI company in Al Khobar; more on our home page. Our ERP and business systems page describes the business systems we build.