ZATCA E-Invoicing Phase 2 for Online Stores: A Plain Guide

ZATCA e-invoicing phase 2 is the stage of Saudi Arabia's e-invoicing system (Fatoora) where your invoicing software stops merely producing invoices and starts connecting to ZATCA. Each invoice has to be created in ZATCA's XML-based format, carry a cryptographic stamp and a QR code, and reach ZATCA's Fatoora platform. It applies in waves chosen by VAT revenue, and ZATCA says it tells each business at least six months before its date.

This guide explains the terms in plain words for an online store owner. It is general information, not tax or legal advice: confirm your position with ZATCA and your accountant. DevMarket does not offer ZATCA integration or e-invoicing software.

What is ZATCA e-invoicing phase 2?

ZATCA describes e-invoicing as an electronic process in which invoices, credit notes and debit notes are exchanged between seller and buyer in a structured format, through an integrated electronic solution.

The roll-out has two phases, set out on ZATCA's roll-out phases page:

• Phase 1, generation. Enforceable since 4 December 2021 for all taxpayers except non-resident taxpayers. Invoices and notes must be generated and stored with a compliant electronic solution.
• Phase 2, integration. Enforceable from 1 January 2023, in waves by taxpayer group. Your solution must integrate with ZATCA's systems and issue invoices in the required format.

Standard and simplified invoices: which does your store issue?

ZATCA names two types of tax invoice. An online store may issue one or both, depending on whether it sells to consumers, businesses or both.

Credit notes and debit notes follow the type of the invoice they correct. A refund on a consumer order is therefore a simplified credit note and is reported too; a credit note for a company is cleared.

ZATCA's detailed guidelines include an online pharmacy that issues a simplified invoice after payment and emails it to the customer. They say a simplified invoice reaches the buyer as a printed copy or, by agreement, an electronic one.

QR code, XML, stamp and onboarding: what changes in Phase 2

The terms in plain words:

• XML is a structured file that software can read. ZATCA publishes a data dictionary and an XML implementation standard that define every field.
• The QR code lets anyone scan an invoice for basic data. In Phase 1 it holds the seller's name and VAT number, the date and time, the total with VAT and the VAT amount. Phase 2 adds more.
• The cryptographic stamp proves who issued the invoice and that its content has not been changed. For simplified invoices, your solution applies it with a certificate identifier (CSID) issued by ZATCA. For standard invoices, ZATCA applies it at clearance.
• Onboarding is how a solution gets its CSID. In ZATCA's technical guideline, you generate a one-time password in the Fatoora portal and enter it in your solution; it sends a certificate signing request, passes compliance checks, and ZATCA issues the CSID. CSIDs expire, so renewal is part of running the system.

Your vendor normally does the API work. A compliant solution must also stop users from deleting or editing issued invoices, so corrections go through credit and debit notes. ZATCA offers a sandbox, an SDK and a web validator for testing. Its guidelines date from 2022 and 2023, so look for newer versions.

Which wave is your business in?

ZATCA selects businesses for each wave by VAT-subject revenue in named years. The threshold has fallen wave by wave:

This is not the full list, only the announcements we opened. Wave 25, published on 24 July 2026, was the latest on ZATCA's news page on 21 October 2026, and later waves are announced at least six months ahead. The Wave 24 date has passed.

How to find out whether and when you are selected:

• Compare your VAT-subject revenue for the years named in each announcement with its criterion, or ask your accountant to.
• ZATCA says it will notify targeted taxpayers directly. The pages we read do not name the channel, so keep the contact details in your ZATCA account up to date.
• Do not wait for a notice to start: Phase 1 already applies to a resident taxpayer, and onboarding and testing take time.

What an online store should do now

1. Ask your accountant to confirm your VAT status and which wave, if any, applies. Our VAT basics cover the groundwork.
2. List every place an invoice is created today: store, accounting software, ERP, point of sale or marketplace.
3. Check Phase 1 first: invoices generated electronically, a QR code on simplified invoices and a proper archive.
4. Map your flows: consumer orders, company orders with a VAT number, refunds, cancellations and partial refunds.
5. Shortlist solutions, ask each vendor the questions below and have every flow tested in ZATCA's sandbox before your date.
6. Onboard each unit, then monitor that every simplified invoice is reported within 24 hours.
7. Train staff to correct mistakes with credit and debit notes, not by editing invoices.

How to choose a compliant solution

Questions to ask a vendor

• Does it support Phase 2 for standard and simplified invoices, and will you get that in writing?
• Does it create the XML, QR code, UUID and hash, handle onboarding and renew certificates?
• What happens when ZATCA is unreachable or rejects an invoice: queueing, alerts, a list of what is outstanding?
• Does it handle credit notes, buyer VAT numbers and Arabic layouts, block editing of issued invoices, and let you export your archive?
• Who updates it when ZATCA changes a specification, on what terms, and how does it connect to your store and point of sale?

ZATCA publishes a solution providers directory of providers that passed its qualification. It states that the list is not an approval of their solutions and that taxpayers may use any company whose solution complies, listed or not.

If you run Odoo, its documentation for the Saudi localisation lists a Phase 1 package and a separate Phase 2 e-invoicing module; check it for the edition and version you need. With WooCommerce or Shopify, ask the plugin or app vendor the same questions.

Mistakes to avoid

• Treating a PDF invoice plugin as a Phase 2 solution. A PDF alone does not cover the XML, stamp, onboarding and reporting.
• Waiting for ZATCA's notice before checking Phase 1.
• Choosing a vendor only because of a directory or marketplace listing.
• Editing or deleting issued invoices instead of issuing a credit note.
• Forgetting company customers: standard invoices must be cleared before you share them.
• Ignoring failed submissions. ZATCA has published violations and fines for e-invoicing, so check the current position with ZATCA.

Frequently asked questions

Does Phase 2 apply to every online store?

Phase 1 applies to all taxpayers except non-resident ones, and Phase 2 applies from the date of the wave that includes you, so a store may still be in Phase 1. ZATCA's guideline says non-resident taxpayers need not issue e-invoices for supplies taxed in the Kingdom; confirm your own status with ZATCA.

Is a PDF invoice from my store plugin enough?

Not on its own. ZATCA's guideline requires Phase 2 invoices to be generated in XML, or in PDF/A-3 with embedded XML, to be stamped, and to be submitted as XML for clearance or reporting.

Can I use any e-invoicing software?

ZATCA says taxpayers may use any company, as long as the solution complies with the requirements. Being listed in its directory is not required and is not an approval.

Does my wave depend on whether I sell online?

No. The criteria are based on VAT-subject revenue in named years, not on the sales channel.

Next step

Work through the checklist above, then talk to your accountant and to the vendor of whatever creates your invoices today. DevMarket does not offer ZATCA integration, and a listing on any marketplace, ours included, is not evidence that an item meets Phase 2, so ask each vendor for specifics. For the wider picture, read our VAT basics and Odoo, WooCommerce or Shopify for a Gulf store. You can also browse Odoo modules and WordPress plugins for other store needs.