ZATCA Phase 2 connects your invoicing system directly to the government. Instead of simply producing a compliant invoice, your system now has to talk to ZATCA's FATOORA platform over an API, in a specific format, with a cryptographic stamp attached.
Phase 1, which started in December 2021, only asked you to stop writing invoices by hand and stop producing them in Word or Excel. Phase 2 is a different order of requirement. It changes what your software has to be capable of, not just what your invoice has to look like.
Where the rollout stands today
Phase 2 began on 1 January 2023 and has been rolling out in waves ever since, each one capturing businesses below the previous revenue threshold.
Wave 25 is the most recent wave ZATCA has announced. It covers taxpayers whose VAT-taxable revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025, and those businesses must be integrated with FATOORA by 1 February 2027.
Wave 24, covering revenue above SAR 375,000, had a deadline of 30 June 2026, which has now passed.
The trajectory is a steady halving of the threshold: SAR 1 million, then 750,000, then 375,000, then 187,500. Wave 25 sits below the SAR 375,000 VAT registration threshold, which means it reaches close to the floor of the VAT-registered population.
ZATCA gives at least six months' notice before each wave's integration date. That commitment is stated in the regulation itself, so if you are not yet in scope, you will not be surprised.
One thing worth being clear about: ZATCA has not announced a final wave or a date by which every taxpayer is covered. Anyone telling you Phase 2 "completes" on a particular date is guessing.
What Phase 2 actually requires
Five things change when a wave reaches you.
Your invoices must be XML. Phase 1 had no format requirement as long as the right data was present. Phase 2 mandates XML for generating and transmitting invoices and credit or debit notes. A PDF/A-3 with the XML embedded is allowed as an optional human-readable version.
Your system must connect to ZATCA over an API. Not a file you upload. A live integration your invoicing system maintains.
Every invoice needs a UUID. A unique 128-bit identifier per invoice. It does not need to appear on the printed invoice, but it must exist in the XML.
Invoices must be cryptographically stamped and hash-chained. Each invoice carries a hash of the invoice before it in the sequence. ZATCA's own wording is that this "protects the sequence of invoices from tampering whether by deletion or replacement." In practice it means you cannot quietly remove an invoice from your books without breaking the chain.
The QR code expands. Under Phase 1, a QR code was required only on simplified invoices and carried five fields. Under Phase 2 it is required on all invoice types and carries nine, including the invoice hash, the signature, and the public key.
Your system also needs a tamper-resistant invoice counter that cannot be reset, and it must keep working offline, queuing invoices and reporting them once the connection returns.
Clearance and reporting are not the same thing
This is the part most businesses get wrong, and it matters because the two models behave completely differently in your day-to-day operations.
Standard tax invoices, meaning B2B and B2G, go through clearance. You submit the invoice to ZATCA in real time. ZATCA validates it, applies its own cryptographic stamp, and notifies you. Only then may you share the invoice with your customer. If ZATCA does not clear it, you do not have a valid invoice to send.
Simplified tax invoices, meaning B2C, go through reporting. You give the customer the invoice immediately. Your own system applies the stamp locally. You then report the invoice to ZATCA within 24 hours.
So a wholesaler issuing B2B invoices has a live dependency on ZATCA in the moment of invoicing. A retailer issuing B2C receipts does not, but has a 24-hour clock running on every transaction.
If your business does both, your system has to handle both models correctly, on the same database, without anyone at the counter having to think about it.
The argument your finance director will care about most
Here is the clause that changes the commercial conversation.
Under ZATCA's Implementation Resolution, to claim input tax deduction, invoices must have been cleared by or reported to ZATCA.
Read that again from your customer's side. If you are in scope for Phase 2 and you are not integrated, your customers may not be able to recover the VAT on what they buy from you.
That turns compliance from an internal finance matter into a commercial one. Large buyers have every reason to ask whether their suppliers are integrated, and to prefer the ones who are.
What non-compliance costs
ZATCA published its e-invoicing penalty framework in November 2021.
- Not issuing e-invoices: fines starting at SAR 5,000
- Deleting or amending e-invoices after issuance, other than through a proper credit or debit note: fines starting at SAR 10,000
- A missing QR code on a simplified invoice, a missing buyer VAT number where required, or failing to notify ZATCA of a malfunction that stops you issuing e-invoices: these begin with a warning
ZATCA states that fines are applied according to the type of violation and the number of repetitions. Separately, the VAT Law caps penalties for failing to keep proper records, and for general breaches of the VAT Regulations, at SAR 50,000, and allows the fine to be doubled if the same violation repeats within three years.
There is also a live amnesty worth knowing about. The Cancellation of Fines and Exemption of Financial Penalties Initiative was extended again from 1 July 2026 and runs to 31 December 2026. It covers late registration, late payment, late filing and penalties for correcting VAT returns, provided you are registered, have filed all outstanding returns, and pay the principal tax due. It does not cover tax evasion penalties, and it explicitly excludes penalties on returns due after 30 June 2026.
One caution: the announcement lists registration, filing and payment penalties. It does not say e-invoicing technical violations are covered. Do not assume they are.
What to do if a wave is coming
Find out which wave you are in. Check your VAT-taxable revenue for 2022 through 2025 against the thresholds. If any of those years exceeded SAR 187,500, you are in scope by 1 February 2027 at the latest.
Check what your current system can actually do. Not what the vendor's website says. Ask specifically: can it produce compliant XML, connect to FATOORA over an API, generate a UUID per invoice, hash-chain the sequence, and handle clearance and reporting as separate flows.
Do not wait for the deadline. Integration involves onboarding with ZATCA, obtaining a cryptographic stamp identifier, and testing in ZATCA's sandbox before you go live. That is not a task for the final week.
Know that "ZATCA-approved software" is not a legal requirement. ZATCA publishes a solution providers directory, but states plainly that taxpayers may choose any solution as long as it is compliant, and that compliance is assessed on the taxpayer, not on whether the vendor appears on the list. The obligation sits with you.
If you are running Odoo, Phase 2 compliance is a configuration and integration exercise rather than a new system. If you are running something that cannot connect to an API at all, the deadline is really a decision about your systems, not about invoicing.