Short answerIn Phase 2, choose software that sends tax invoices to ZATCA for clearance before delivery, stamps simplified invoices itself and reports them within 24 hours, produces XML with a QR code, and has no prohibited functions. Every invoicing device must be onboarded to Fatoora; test on simulation first. A ZATCA listing is not required: ask for proof, not promises.
What must the software do in Phase 2?
Phase 2, integration with the Fatoora platform, has been enforceable in waves since 1 January 2023; ZATCA notifies each business of its wave at least six months ahead. The software must run two flows: clearance for tax invoices and reporting for simplified tax invoices. See the integration waves guide.
A tax invoice, generally used between businesses and with government, is sent to ZATCA in real time; ZATCA validates and stamps it before it reaches the buyer, and clearance is a condition of its validity. A simplified tax invoice is generally for consumers: your software stamps it and reports it within 24 hours. See the tax vs simplified invoice guide.
- Tax invoices, simplified tax invoices, and their credit and debit notes.
- XML for generating and sending documents to ZATCA; PDF/A-3 with embedded XML is optional, for customers only.
- A QR code; on simplified invoices, 9 tags in base64-encoded TLV format.
- Fields mandatory from the integration phase: a UUID, the previous invoice hash, a tamper-resistant counter, and an additional seller ID such as the CR number.
A paper invoice that is scanned or copied into electronic form is not an e-invoice.
Which prohibited functions must the software not have?
Annex 1 of the E-invoicing Implementation Resolution lists functions no invoicing solution may contain. Including any of them is violation 11, so do not settle for a vendor's word; ask to see how the software blocks each item.
- Since 4 December 2021: uncontrolled or anonymous access, operating with a default password, and no session management.
- Since 4 December 2021: altering or deleting issued invoices or their logs, and inaccurate timestamps.
- Since 4 December 2021: resetting the invoice counter, or running multiple invoice sequences.
- From the integration phase: exporting the cryptographic stamping key, and allowing time changes.
Deleting or modifying an issued e-invoice is a separate violation too, so ask how mistakes are corrected without touching the original.
How to choose e-invoicing software: a vendor checklist
Take this table to any vendor meeting. The middle column is what ZATCA's documents say; the last is what to see yourself in a live demo or on the simulation environment.
| Criterion | What ZATCA says | Ask to see |
|---|---|---|
| Clearance and reporting | Tax invoices cleared before delivery; simplified invoices reported within 24 hours | One invoice of each type through ZATCA, response saved |
| Format | XML to ZATCA; PDF/A-3 optional for customers | The XML file and the customer copy |
| QR code | Required; 9 tags in base64 TLV on simplified invoices | The code scanned from a printout |
| Devices | Every invoicing device under the same VAT number is registered | Onboarding a new branch or cashier |
| Certificates | Production CSID after the compliance checks, renewed before expiry | Certificate status and renewal date |
| Prohibited functions | No editing or deleting after issue, no counter reset, no time changes | Editing a cleared invoice, and the system refusing |
| Outages | 24 hours to report simplified invoices; faults notified via ZATCA's form | Retry queue and attempt log |
| Storage and sharing | Stored in the set format; shared with customers in the required format | A full export of invoices and records |
How is the software connected to Fatoora?
ZATCA sets the steps; products differ in how clearly they guide you. You log in to the Fatoora portal (fatoora.zatca.gov.sa) with your ERAD credentials, not Developer Portal ones, and your VAT registration must be Active or Reactive.
- Confirm the solution is integration-ready, then onboard a new unit or device in the portal and generate a one-time password (OTP).
- The 6-digit OTP must be entered in the software within one hour; request 1 to 100 at a time.
- The software generates a key pair and sends a Certificate Signing Request (CSR) carrying your VAT number (15 digits, starting and ending with 3).
- It submits test documents for its invoice type, such as a tax invoice, debit note and credit note; if any test fails, onboarding restarts.
- When the checks pass, a production CSID is issued for clearance and reporting, and it is renewed before it expires.
Simulation is separate from production, with its own device onboarding, so ask for a full run there first. Details in the Phase 2 guide.
Which violations does the right software help you avoid?
Under ZATCA's simplified guide to classifying violations (second edition, May 2024), every general violation starts with a warning and 30 to 60 days to fix it (obstructing staff: 10 days); fines rise with each repeat within 12 months of the last detection. These violations relate to the software:
| Violation (guide number) | First time | Second time | After the sixth | Periodicity |
|---|---|---|---|---|
| Not integrating all e-invoicing systems with ZATCA (8) | Warning | SAR 10,000 | SAR 50,000 | 30 days |
| A prohibited function in the solution (11) | Warning | SAR 5,000 | SAR 40,000 | 30 days |
| Deleting or modifying an invoice after issue (12) | Warning | SAR 5,000 | SAR 40,000 | 30 days |
| Not storing invoices in the set format (13) | Warning | SAR 1,000 | SAR 40,000 | 60 days |
| No QR code on the invoice (15) | Warning | SAR 1,000 | SAR 40,000 | 60 days |
| Missing data fields sent to ZATCA (16) | Warning | SAR 1,000 | SAR 40,000 | 60 days |
ZATCA's example: a restaurant integrated 2 of its 3 cashier devices. It gets a warning, then a SAR 10,000 fine if the violation is found again after 30 days. Full list in the violations guide.
Does e-invoicing software work without internet?
Partly. Your software stamps a simplified invoice itself, the buyer gets it at once, and you have 24 hours to report it to ZATCA. If you cannot, notify ZATCA through the dedicated form on its website and report once the connection returns.
A tax invoice needs clearance before delivery. It may be issued within 15 days of the end of the month of supply, but an uncleared invoice is not eligible for input VAT deduction; keep evidence of clearance attempts, such as API logs.
- An automatic retry queue that drops no invoice.
- A log of every attempt and every ZATCA response.
- A view of simplified invoices still inside the 24-hour window.
Not notifying ZATCA of faults that hinder invoicing is a separate violation (14): a warning, then SAR 1,000 rising to 40,000.
Does ZATCA certify software, and must the vendor be listed?
Under the E-invoicing Implementation Resolution, a solution is compliant once its conformity is verified by ZATCA, a third party, or the business's own self-certification, under ZATCA's mechanisms. The Zakat, Tax and Customs Authority also publishes an indicative list of providers that passed its qualification process; you may choose any compliant provider, listed or not.
The business is responsible for compliant invoices and for integrating all its invoicing systems with Fatoora. So judge vendors on evidence you can check: a real onboarding on simulation, accepted compliance documents, a certificate request carrying your own VAT number, and a full export of your records. Official answers: ZATCA on 19993 or zatca.gov.sa.
How does Xrero handle these criteria?
Xrero is a cloud ERP in Arabic and English, provided in Saudi Arabia by SIF International (S I F International Company), Riyadh. It issues tax and simplified invoices and their credit and debit notes as UBL 2.1 XML with a cryptographic stamp, hash chain and QR code, and simplified invoices from the point of sale. Counters never reset, cleared invoices cannot be edited or deleted, and corrections are notes referencing the original.
The onboarding wizard requests certificates in your business's name, never ours; the readiness dashboard shows certificate status and every ZATCA answer. E-invoicing is included in every licence; the trial is 15 days, no credit card. See e-invoicing and pricing, or contact us in Riyadh.
- 18 September 2026: validated on ZATCA's developer sandbox, with all six compliance document types accepted, live clearance, reporting and a credit note accepted with zero warnings.
- 28 September 2026: a Saudi establishment's device was onboarded on the Fatoora simulation environment through Xrero, with six compliance documents accepted and a production CSID issued in simulation.
- 28 September 2026: the application to be listed in ZATCA's solution-provider directory was submitted and is under review.
Frequently asked questions
How do I choose the right e-invoicing software for my business?
Start with your invoice types: tax invoices need clearance, and simplified invoices need reporting within 24 hours. Then check XML, the QR code, mandatory fields, prohibited functions, device onboarding and outage handling. Test fully on the simulation environment before you sign.
Does ZATCA certify e-invoicing software?
A solution is compliant once its conformity is verified by ZATCA, a third party, or the business's own self-certification, under ZATCA's mechanisms (Implementation Resolution). ZATCA publishes an indicative list of qualified providers, but any compliant provider is allowed. The business stays responsible for its invoices and for integrating all its systems with Fatoora. Official answers: 19993 or zatca.gov.sa.
What must e-invoicing software meet in Phase 2?
XML documents with a QR code, UUID, previous invoice hash and tamper-resistant counter; clearance of tax invoices and reporting of simplified ones within 24 hours; and no prohibited functions, such as deleting invoices, resetting the counter or exporting the stamping key.
Must the vendor be listed in ZATCA's solution-provider directory?
No. ZATCA's list is indicative: any provider whose solution meets the e-invoicing requirements is allowed, and ZATCA considers your compliance even if the provider is not listed. Ask for a real onboarding on the simulation environment, and check the certificate request carries your own VAT number.
Does e-invoicing software work without internet?
Partly. Your software stamps simplified invoices and reports them within 24 hours; if that fails, notify ZATCA through its form and report once back online. A tax invoice needs clearance before it reaches the buyer, so it cannot be completed offline.
Official sources
- ZATCA - Simplified guide to classifying general VAT violations (Arabic, 2nd edition, May 2024)
- ZATCA - E-Invoicing Implementation Resolution and annexes (prohibited functions, mandatory fields)
- ZATCA - E-Invoicing Detailed Guidelines
- ZATCA - E-Invoicing Detailed Technical Guidelines (onboarding and certificates)
- ZATCA - FATOORA Portal User Manual
- ZATCA - How to get ready for Phase 2
- ZATCA - E-invoicing roll-out phases
- ZATCA - E-Invoicing page (Solution Providers Directory)