Phase 1 of e-invoicing, the Generation phase, began on 4 December 2021 and required everyone subject to the regulation to generate and keep invoices and credit and debit notes electronically. ^[1] Phase 2, the Integration phase, began on 1 January 2023 and is rolled out in waves by target group; it requires invoicing systems to be integrated with ZATCA’s systems through an application programming interface. ^[1]

ZATCA sums up what Phase 2 adds in three points: connecting e-invoicing solutions to the FATOORA platform, issuing invoices in a specific format and adding new fields to the invoice. ^[4] In other words, a business no longer simply issues and stores an invoice; the invoice now passes through ZATCA either before it reaches the buyer or immediately after.

Who is in scope for Phase 2, and when?

ZATCA determines the target groups and their phases, and notifies each group at least six months before its integration date. ^[1] The most recent announced at the time of writing (November 2026) is Wave 25, which covers all taxpayers whose VAT-subject revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025; they must complete integration with FATOORA by 1 February 2027 at the latest, and ZATCA will notify those targeted directly. ^[4]

The requirements apply to resident taxable persons and to any customer or third party issuing a tax invoice on their behalf, but not to non-resident taxable persons. ^[2] In-scope documents cover standard-rated and zero-rated supplies, exports, intra-GCC supplies and advance payments; fully exempt supplies, reverse-charge supplies and imports are excluded. ^[1]

Clearance and reporting: two routes for two invoice types

The core of Phase 2 is that tax invoices and simplified invoices follow different routes:

• Tax invoice (B2B): sent to ZATCA for clearance; ZATCA checks it and adds its cryptographic stamp to those that pass its controls, and only then is it shared with the buyer. The same applies to associated credit and debit notes. ^{[1, 2]}
• Simplified invoice (B2C): given to the buyer immediately and reported to ZATCA within no more than 24 hours of issue, carrying the cryptographic stamp. ^{[1, 2]}

The Implementation Resolution makes input tax deduction conditional on invoices having been cleared or reported, from a date ZATCA announces. ^[1] So an integration failure at the supplier does not stay an internal technical problem; it can become a financial problem for the customer.

What must every electronic document carry?

Invoices must be issued in XML, or as PDF/A-3 with embedded XML, and whatever is submitted to the platform for clearance or reporting must be in XML. ^{[1, 2]} An ordinary PDF sent to the customer is not enough. ^[2]

The Implementation Resolution sets out technical elements that protect the invoice’s integrity: ^[1]

• A unique identifier (UUID) for each invoice or note, alongside its sequential number.
• A hash of each invoice embedded in the next one, chaining invoices together so that any change is detectable.
• A counter that cannot be reset or reformatted.
• A cryptographic stamp using a registered stamp identifier and a non-exportable key.
• A QR code, mandatory on all invoices and notes, containing data such as the seller’s name and VAT number, date and time, totals, the hash and the signature.

A tax invoice comes back from clearance carrying the QR code and ZATCA’s stamp, and is then shared with the buyer. ^[2]

Solution requirements and prohibited functions

ZATCA does not mandate a particular system, but it prohibits functions that open the door to tampering, including: ^{[1, 3]}

• Uncontrolled access, such as anonymous log-in, default passwords or no user session management.
• Editing or deleting invoices, notes or logs after they are issued.
• More than one invoice sequence, or resetting the counter.
• Exporting the cryptographic stamping keys.
• Changing the system time during issuance.

On storage, the solution must allow invoices to be exported to a local archive without an internet connection, and exported archive files must be named with the VAT number, issue date, issue time and invoice reference number. ^[1] Invoices may be stored on premises in the Kingdom or in the cloud, provided ZATCA can access the data. ^[2] Retention periods follow the VAT Implementing Regulations: at least 6 years for records in general. ^{[1, 5]}

Steps to integrate with FATOORA

The onboarding step itself is short: the taxpayer logs in to the FATOORA portal with their ZATCA e-services credentials, requests a one-time password (OTP) for the solution and enters it in the solution within its validity period, and the solution obtains its cryptographic stamp identifier (CSID). ^{[2, 3]} Every device or unit issuing invoices under the same VAT number must be onboarded. ^[2] But the real work comes before this step:

Mapping the issuing points and cleaning customer data usually take the most time, because data errors that used to slip through can now hold up clearance of a tax invoice, and every branch or point-of-sale device left unconnected becomes a point of non-compliance.

Who owns the project inside the business?

A common planning mistake is to treat integration as a technical task for the solution provider alone. It is better led by the finance director or tax lead, because its key decisions are financial: which transactions get a tax invoice and which a simplified one, how returns and discounts are handled through credit notes, and who follows up rejected invoices each day. IT handles integration, security and access rights, and the provider tests the scenarios finance defines before go-live.

What if the connection to the platform fails?

The Implementation Resolution expects the solution to queue invoices while offline and send them once the connection is restored. ^[1] The taxpayer must notify ZATCA of incidents, and resume integration and submit the affected invoices promptly once the problem is fixed. ^[1]

The Detailed Guideline sets out the procedure for each case, including keeping evidence of submission attempts and notifying ZATCA through the dedicated form if the 24-hour window for a simplified invoice is missed. ^[2] It is worth writing a short contingency procedure that sets out who monitors pending invoices, when the issue is escalated to the solution provider and when ZATCA is notified.

Mistakes businesses make in the first months

ZATCA highlights recurring errors, including manual invoices, using a non-compliant solution, generating invoices that do not meet the requirements and deleting invoices after they are generated. ^[3] In practice, another one is connecting the main systems while forgetting secondary systems that also issue invoices, such as a returns module or point-of-sale terminals in a remote branch.

Hypothetical example

A Jeddah distribution company in a recent wave issues invoices from a main accounting system and ten point-of-sale terminals in its showrooms. It connected the main system to the platform before the deadline but never mapped the terminals, so two of them kept issuing simplified invoices from an old software version that did not report them. Finance found the gap when it compared showroom sales with reported invoices. The lesson: a daily report reconciling what was issued with what was cleared or reported catches these gaps before ZATCA does.

Conclusion

Phase 2 is not a change to the look of the invoice but to its route: a tax invoice is cleared before it reaches the customer, and a simplified invoice is reported within 24 hours. Start by mapping every issuing point and cleaning customer data, choose a compliant solution, and put a written procedure for outages in place well before your wave’s deadline.

A tax invoice is not just a commercial document; it is the evidence the buyer relies on to recover input tax. In the UAE the Decree-Law requires a registrant to receive and retain the tax invoice before recovering input tax. ^[3] In Saudi Arabia input tax can be deducted only with a tax invoice, a customs document or other evidence ZATCA accepts. ^[1] So a seller’s invoicing error usually becomes the buyer’s loss.

The core details are similar in both countries: the words “Tax Invoice”, a sequential number, the issue date and the supply date if different, the seller’s name, address and registration number, a description of the goods or services with quantities and prices, and the tax rate and amount. ^{[1, 2]} The detail differs, as the table shows.

Error 1: a simplified invoice where a full one is needed

A simplified invoice leaves out the buyer’s details and much else, so its use is limited. In the UAE the Executive Regulation allows it where the recipient is not a registrant, or is a registrant and the consideration does not exceed AED 10,000; it is not permitted for supplies where the buyer accounts for tax under the reverse charge. ^[2]

In Saudi Arabia ZATCA’s guideline allows a simplified invoice for supplies to individuals who are not subject to VAT, whatever the value, and also refers to supplies worth less than SAR 1,000; supplies to a business or a government entity normally call for a full tax invoice. ^[1] Under e-invoicing, the standard tax invoice is classed as business-to-business and the simplified invoice as business-to-consumer. ^[5]

The typical error is a point-of-sale system set to issue simplified invoices to every customer, so a corporate client receives an invoice without its registration number and cannot recover the tax.

Error 2: missing or incorrect buyer details

A full invoice must show the buyer’s name and address, and its registration number if it is registered. ^{[1, 2]} ZATCA’s guideline adds that where the buyer is not registered, one of a set list of identifiers must be shown, such as the commercial registration, the 700 number, the national ID or the residency number, together with the identifier type, following the order of the list if more than one is available. ^[1]

The errors that recur most often here:

• A registration number copied with a digit missing or added, or a branch number used instead of the registered entity’s number.
• A shortened trading name instead of the registered legal name.
• An old address after the client has moved, because the customer record was never updated.

The fix is not to check every invoice but to set up the customer record once: no corporate customer is activated in the system until its registration number and legal name have been checked against its registration certificate.

Error 3: currency and language

ZATCA’s guideline requires the tax amount to be shown in Saudi riyals, with foreign-currency amounts converted at the Saudi Central Bank’s daily rate on the date the tax becomes due. ^[1] It also requires the invoice to be issued in Arabic, with another language allowed alongside; an invoice lacking the required details in Arabic is not a valid tax invoice, although ZATCA may, at its discretion, accept one that meets the other requirements as alternative evidence for deducting input tax. ^[1] Tax is rounded to the nearest halala. ^[1]

In the UAE the tax amount must be shown in UAE dirhams, with the exchange rate used if the invoice is in another currency. ^[2] A common error among exporters and international service firms is to issue the whole invoice in US dollars without showing the tax in the local currency.

Error 4: late issue and editing invoices after issue

The deadline differs between the two countries, and mixing them up causes errors in companies working in both markets:

• Saudi Arabia: a tax invoice no later than 15 days after the end of the month in which the supply took place, and a simplified invoice on the date of supply or payment, whichever is earlier. ^[1] The guideline allows a summary invoice covering supplies to the same customer over a period of no more than one calendar month. ^[1]
• UAE: an invoice within 14 days of the date of supply. ^[3] A simplified invoice on the date of supply, and a summary invoice within 14 days after the end of the calendar month. ^[2]

On corrections, ZATCA’s guideline states that an invoice is issued once and its issue date is not amended, and that any later change, such as returns, discounts, cancellations or errors, is handled with a credit or debit note that carries its own serial number and refers to the original invoice number. ^[1] In the UAE a tax credit note shows the value on the original invoice, the corrected value, the difference, the tax on it and a brief reason for issuing it. ^[2]

The recurring error is to “reissue” the same invoice under the same number with a new amount, or to delete it and issue another, which breaks the sequence and the link between the return and the invoice.

Errors that cost more than they seem

Invoicing without registration. In Saudi Arabia a person who is not registered may not issue a tax invoice, and anyone who collects VAT or issues such a document without registering faces a fine of up to SAR 100,000. ^[1] In the UAE the Decree-Law requires a registrant making a taxable supply to issue an original tax invoice and deliver it to the recipient, so the tax invoice is tied to registration from the outset. ^[3]

Leaving out the reverse-charge statement. In the UAE, where the recipient is required to account for the tax, the invoice must say so and refer to the relevant provision. ^[2]

Self-billing without meeting the conditions. In Saudi Arabia a buyer may issue invoices on the supplier’s behalf only under a prior written agreement with ZATCA notified, with the wording “Issued on behalf of the Supplier”, and the supplier remains responsible for their accuracy. ^[1] In the UAE the Executive Regulation requires a written agreement, a registered recipient and the wording “Tax Invoice raised by buyer”. ^[2]

Incomplete record-keeping. ZATCA’s guideline requires records to be kept for at least 6 years from the end of the tax period, 11 years for movable capital assets and 15 years for real estate records, in Arabic and within the Kingdom. ^[1]

How does e-invoicing change these errors?

In Saudi Arabia manual invoices are no longer acceptable: invoices have been generated by compliant electronic solutions since the first phase on 4 December 2021, and integrated with the FATOORA platform in waves since 1 January 2023. ^[5] Among the pitfalls ZATCA highlights are using a non-compliant solution and deleting an invoice after it has been generated. ^[5]

In the UAE the Ministry of Finance’s guidelines set mandatory e-invoicing for businesses with annual revenue of AED 50 million or more from 1 January 2027, for smaller businesses from 1 July 2027, and for government entities from 1 October 2027. Each group must first appoint an accredited service provider: by 31 October 2026 for the largest businesses and by 31 March 2027 for the others. ^[4] Where a registrant must issue tax invoices electronically, the Executive Regulation’s provisions on simplified invoices and certain other concessions no longer apply. ^[2] Details that were once tolerated will become technical conditions for acceptance.

Checklist before sending an invoice

Hypothetical example

A Riyadh consultancy provides advice worth SAR 20,000 to a VAT-registered Saudi company and issues an invoice in English only, in US dollars, without the client’s registration number. VAT at 15% comes to SAR 3,000, but this is not a valid tax invoice: it lacks the Arabic details, the tax in riyals and the buyer’s details, so the client cannot rely on it to deduct the tax. ^[1] The right correction is not to edit the same invoice but to deal with it under the credit and debit note rules and issue a correct document, then fix the customer record and the invoice template so the error does not recur.

Conclusion

Most invoicing errors do not come from not knowing the tax rate; they come from a poorly configured invoice template, out-of-date customer data and confusion between the two countries’ rules. Set the invoice type, customer details, currency and language correctly in the system, handle every change with a credit or debit note, and you will avoid most of what auditors find.