ZATCA Phase 2, also called the Integration phase, requires VAT-registered businesses in Saudi Arabia — as ZATCA brings them in, wave by wave — to connect their invoicing systems directly to ZATCA’s FATOORA platform. Every invoice has to be produced as structured UBL 2.1 XML with a cryptographic stamp, a QR code, and a hash that links it to the previous invoice. Standard tax invoices (B2B and B2G) must be cleared by FATOORA before they reach the buyer. Simplified invoices (B2C) must be reported within 24 hours of issue.
For most companies, the hard part is not understanding the rules. It is making an existing ERP or billing system produce compliant invoices reliably, onboarding each invoicing unit with ZATCA, and handling rejections without holding up sales or collections. This guide covers what Phase 2 requires, how the technical pieces fit together, and how to plan an integration that finance and IT can both support.
Phase 1 vs Phase 2: what changes
Phase 1, “Generation,” took effect on 4 December 2021. Businesses had to generate and store invoices electronically using a compliant solution, and simplified invoices needed a QR code.
Phase 2, “Integration,” began on 1 January 2023. It is being rolled out in waves of taxpayers selected by ZATCA, usually based on revenue thresholds. ZATCA notifies selected taxpayers in advance, commonly cited as at least six months before their go-live date.
| Area | Phase 1 (Generation) | Phase 2 (Integration) |
|---|---|---|
| Invoice format | Electronic (no mandated format) | UBL 2.1 XML (PDF/A-3 with embedded XML allowed for sharing) |
| Connection to ZATCA | None | Direct API integration with FATOORA |
| Standard (B2B) invoices | Issued directly to buyer | Must be cleared by FATOORA before issue |
| Simplified (B2C) invoices | QR code required | Reported to FATOORA within 24 hours, with enhanced QR code |
| Security | Basic tamper resistance | Cryptographic stamp, hash chaining, onboarded device certificates |
| System registration | Not required | Each EGS unit onboarded with a CSID |
Your exact go-live date, and any updates to the technical specifications, are in your ZATCA notification and the official guidance at zatca.gov.sa.
Clearance vs reporting: the two invoice flows
Phase 2 has two separate flows, and your system needs to route each document to the correct one.
Clearance for standard tax invoices (B2B and B2G)
A standard tax invoice goes to a VAT-registered business or a government entity. Under Phase 2 it has to be cleared:
- Your system generates the invoice XML.
- It sends the XML to the FATOORA clearance API.
- FATOORA validates it. If it passes, FATOORA applies its own cryptographic stamp and returns the cleared invoice.
- Only the cleared invoice can be shared with the buyer.
If FATOORA rejects an invoice, for example over a missing buyer VAT number, it has not been legally issued. Your team needs a way to fix and resubmit it quickly.
Reporting for simplified tax invoices (B2C)
A simplified tax invoice goes to a consumer, often at a point of sale. The flow is:
- Your system generates the invoice XML, signs it with its own cryptographic stamp, and produces the QR code.
- The invoice is given to the customer immediately.
- Your system reports the signed XML to FATOORA within 24 hours of issue.
Because the customer gets the invoice before ZATCA sees it, the signing and QR generation must be correct at the source.
Credit and debit notes
Credit and debit notes follow the same rules as the invoice type they relate to. A credit note against a standard invoice is cleared, and a credit note against a simplified invoice is reported. Each note must reference the original invoice and state a reason.
What a compliant Phase 2 invoice contains
A Phase 2 invoice is a structured data document with built-in security, not just a PDF with the right fields:
- UBL 2.1 XML. The legal invoice is an XML file following the UBL 2.1 standard, with ZATCA-specific fields and business rules.
- PDF/A-3 with embedded XML. For sharing a readable invoice with buyers, ZATCA allows a PDF/A-3 file with the XML embedded inside it. The XML is still the authoritative version.
- UUID. Every invoice gets a universally unique identifier, separate from your own invoice number.
- Invoice Counter Value (ICV). A sequential counter maintained by each invoicing unit. It must increase without gaps or resets.
- Previous Invoice Hash (PIH). Each invoice includes the hash of the previous invoice produced by the same unit. This creates a chain, so deleting or changing an invoice breaks the chain and becomes detectable.
- Cryptographic stamp. A digital signature created with the private key tied to your unit’s certificate. It proves the invoice came from your onboarded system and has not been changed.
- QR code. The Phase 2 QR code carries more data than in Phase 1, including elements of the cryptographic stamp, so the invoice can be checked for authenticity.
The ICV and PIH requirements have real design consequences. Each invoicing unit must produce invoices in a strict sequence and keep track of its last hash. With several branches or POS terminals, decide how many units to onboard and how each keeps its chain.
EGS onboarding and CSIDs
Before a system can clear or report invoices, it has to be registered with ZATCA as an E-invoice Generation Solution (EGS) unit. Each unit gets a Cryptographic Stamp Identifier (CSID), which is the certificate it uses to sign invoices and authenticate with FATOORA.
Onboarding follows this sequence:
- Get an OTP from the FATOORA portal. An authorized user logs in to the FATOORA portal and generates a one-time password for onboarding a unit.
- Generate a CSR. The EGS creates a private key and a Certificate Signing Request containing the unit’s details, such as VAT number, branch or organizational unit, and the invoice types it will issue.
- Get a compliance CSID. The system submits the CSR and OTP to ZATCA and receives a compliance CSID, which is a temporary certificate for testing.
- Run compliance checks. Using the compliance CSID, the system submits sample invoices, credit notes and debit notes for each invoice type it will issue. ZATCA validates each one.
- Get a production CSID. Once the compliance checks pass, the system requests a production CSID. From then on, the unit can clear and report live invoices.
Some practical points:
- Protect the private keys. Anyone who has a unit’s private key can sign invoices as that unit. Store keys in a secure vault or hardware module, restrict access, and log every use.
- Track certificate expiry. CSIDs expire. Build a renewal process with alerts well ahead of time, so invoicing does not stop without warning.
Integration approaches for an existing ERP
Most companies already run an ERP or billing system, so the question is how to connect it to FATOORA.
Native ERP module
Many major ERP vendors, and some local resellers, offer Phase 2 modules or localization packages. If your ERP version is current and the vendor’s module covers your invoice types, this is usually the simplest route. The risks are version dependency, since older or heavily customized systems may not be supported, and less control over how errors appear to your users.
Middleware or connector
A middleware layer sits between your ERP and FATOORA. The ERP sends invoice data to the middleware, which builds the XML, signs it, manages ICV and PIH, calls the ZATCA APIs and sends the result back. It suits companies with several source systems, or an ERP that cannot be upgraded soon.
Custom integration
A custom integration builds Phase 2 logic directly into your system or into a dedicated service your team owns. It gives the most control, but you must track ZATCA specification changes and maintain the cryptographic components yourself.
| Factor | Native ERP module | Middleware / connector | Custom integration |
|---|---|---|---|
| Speed to go-live | Fast if supported | Moderate | Slowest |
| Fit for legacy or customized ERPs | Limited | Good | Good |
| Multiple source systems | Weak | Strong | Strong, with effort |
| Control over logic and errors | Low | Medium | High |
| Ongoing maintenance burden | Vendor-led | Shared with provider | Fully in-house |
| Dependence on third parties | ERP vendor | Middleware provider | Minimal |
Whichever approach you choose, the ERP still needs clean master data, correct VAT configuration and a clear process for rejected invoices. If you are also planning an ERP upgrade or replacement, align the two projects so you do not build Phase 2 twice. Our ERP Implementation work often covers this sequencing.
A step-by-step Phase 2 readiness plan
- Confirm your wave and deadline. Read your ZATCA notification carefully and note your go-live date.
- Inventory every invoicing source. List all systems that issue invoices, credit notes or debit notes, including POS, e-commerce and manual processes.
- Classify your documents. For each source, identify standard vs simplified invoices, plus special cases such as exports, exempt supplies and advance payments.
- Clean your master data. Check customer VAT numbers, commercial registration details, national addresses and product VAT categories. Poor master data causes many clearance rejections.
- Choose your integration approach. Compare native, middleware and custom options against your ERP version, number of source systems and internal skills.
- Design your EGS unit structure. Decide how many units to onboard, where the keys will be stored and how the ICV and PIH will be managed per unit.
- Build and map the XML. Configure or develop XML generation, signing, QR codes and PDF/A-3 output. Map every ERP field to the correct UBL element.
- Onboard and run compliance checks. Generate OTPs, submit CSRs, obtain compliance CSIDs and pass the compliance checks for every document type you issue.
- Test real business scenarios. Run end-to-end tests with realistic data: partial credit notes, multi-currency invoices, discounts, rounding and API outages.
- Define the exception process. Agree who monitors rejections and reporting failures, who fixes them, and how quickly. Document it for the finance team.
- Go live and monitor. Switch to production CSIDs, watch the first invoicing cycles closely and reconcile what FATOORA has accepted against your ERP.
- Plan ongoing support. Assign owners for certificate renewal, specification updates and system changes. Our Support & Optimization service can cover this after go-live.
Common mistakes to avoid
- Treating Phase 2 as an IT-only project. Invoice classification, VAT treatment and customer data are finance decisions.
- Starting too late. Master data cleanup, vendor lead times and compliance testing all take time.
- Ignoring credit and debit notes. Teams often test invoices thoroughly and find credit note problems only after go-live.
- Breaking the hash chain. Restoring a database backup, running parallel test and production instances, or resetting a counter can break ICV and PIH continuity.
- Weak key management. Leaving private keys in plain configuration files or shared folders is a security and compliance risk.
- No plan for outages. Clearance depends on the FATOORA API being reachable. Define how your business will respond if it is not, based on current ZATCA guidance.
Frequently asked questions
When do I need to comply with ZATCA Phase 2?
Phase 2 is rolled out in waves. ZATCA notifies each selected taxpayer in advance, commonly at least six months before their go-live date. Your notification states your specific deadline.
What is the difference between clearance and reporting?
Clearance applies to standard tax invoices (B2B and B2G): FATOORA must validate and stamp the invoice before it reaches the buyer. Reporting applies to simplified invoices (B2C): you issue the invoice immediately and report it within 24 hours.
What is a CSID and why do I need one?
A Cryptographic Stamp Identifier is the certificate ZATCA issues to each onboarded EGS unit. It lets the unit sign invoices and authenticate with FATOORA. You need a compliance CSID for testing and a production CSID for live invoicing.
Can I keep my current ERP?
Usually, yes. Most organizations add Phase 2 through a native module, a middleware connector or a custom integration.
What happens if we do not comply?
Non-compliance can lead to penalties from ZATCA. Rejected invoices can also delay billing and collections.
Getting help with your integration
AIMLTS is based in Jeddah and builds ZATCA Phase 1 and Phase 2 e-invoicing into existing ERP and billing systems. That work covers UBL 2.1 XML, PDF/A-3, QR codes, cryptographic stamps, EGS onboarding, and FATOORA clearance and reporting. See our ZATCA & E-Invoicing service for details, or book a discovery call to talk through your deadline, your systems and the integration approach that suits them.