ZATCA Phase 2 — what every Saudi small business needs to know in 2026.

2026-05-01 · 8 min read · By Northlane Tech

If you run a Saudi business — restaurant, salon, clinic, contractor, e-commerce store — there's a good chance ZATCA Phase 2 has shown up in your inbox or your accountant's WhatsApp by now. Most explanations are written in tax-law dialect. This one isn't.

By the end of this article you'll know exactly: who's affected, when it kicks in for your business, what "compliant" actually requires under the hood, and the fastest path to being ready.

The 30-second summary

• Phase 1 (started Dec 2021) made all VAT-registered businesses in Saudi Arabia generate electronic invoices instead of paper ones.
• Phase 2 (started Jan 2023, rolling out in waves) requires those e-invoices to be integrated directly with ZATCA's Fatoora platform, in real time, in a specific XML format with cryptographic stamps.
• Each wave includes businesses above a certain VAT-registered annual revenue threshold. Each business is given a 6-month notice before its wave activates.
• If you ignore it: fines start at SAR 1,000 and escalate quickly.

So am I in a wave yet?

ZATCA notifies you directly through your taxpayer portal and via SMS / email. As a rule of thumb:

• If your VAT-eligible revenue is over SAR 3 million / year, you're almost certainly already in an active wave.
• Below that, you're likely in an upcoming wave — the thresholds keep dropping as ZATCA brings smaller and smaller businesses online.
• The endgame: every VAT-registered business in Saudi Arabia.

"It's not a question of if, it's when. Plan now and you have time. Plan when ZATCA sends the 6-month notice and you're already late."

What "compliant" actually means under the hood

This is the part most articles skip. Phase 2 isn't just "send invoices by email instead of paper." It requires your invoicing system to do five specific things:

1. Generate invoices in UBL 2.1 XML format

Plain PDFs and Excel spreadsheets don't qualify. Your invoices must be structured XML following the UBL 2.1 standard with ZATCA's specific Saudi extensions.

2. Include a QR code on every invoice

The QR encodes a TLV (Tag-Length-Value) structure with the seller name, VAT number, timestamp, total, VAT amount, and a hash. Any phone scanning it should be able to verify the invoice instantly.

3. Submit (or "clear") each invoice through ZATCA's Fatoora API

For B2B invoices: real-time clearance — ZATCA must approve the invoice before you give it to the customer. For B2C: reporting within 24 hours.

4. Sign each invoice with a cryptographic stamp

You receive a Cryptographic Stamp Identifier (CSID) from ZATCA after onboarding. Every invoice carries an XML signature using that stamp. This is what makes invoices tamper-evident.

5. Maintain immutable invoice storage for 6 years

Saudi tax law requires you to retain invoices for a minimum of 6 years. With electronic invoices, that means a system that can produce them on demand, in their original signed form.

The cost of getting it wrong

Penalties for non-compliance under Saudi VAT regulations:

• Failure to issue an electronic invoice: up to SAR 50,000 per violation.
• Issuing an invoice missing required data: warnings followed by escalating fines.
• Using non-compliant software: ZATCA can require you to migrate to a compliant solution at your own cost, plus penalties.

Beyond the fines, a non-compliant business cannot legitimately bill VAT-registered customers (most B2B clients refuse non-compliant invoices because they then can't claim VAT input).

The three paths to compliance

Path A: Use a ZATCA-certified SaaS provider

Companies like Zoho Books, QuickBooks Saudi, Onsi, Wafeq, and others offer Phase-2-ready accounting software. Pros: no integration work. Cons: monthly fees scale with revenue and users; you don't own the data; switching later is painful; localization quality varies.

Path B: Buy a Saudi-compliant POS

Many POS vendors have added ZATCA Phase 2 support. Good for restaurants and retail with a single sales channel. Less good if you sell across multiple channels or do project-based invoicing.

Path C: Custom-build your invoicing system, ZATCA-integrated

For businesses that already have a custom CRM / booking / inventory system, or for whom the off-the-shelf options are awkward (multi-location chains, marketplaces, B2B project shops), a custom Phase-2-compliant system is often the right call. You own the code, the data lives in your accounts, no per-user fees, and it integrates with whatever tools you already use.

Until recently, Path C took weeks of integration work. With AI-driven build pipelines, it's now a 5–10 day delivery.

How we approach it at Northlane Tech

When a client comes to us for ZATCA Phase 2:

1. 15-minute scoping call on WhatsApp — we figure out: are you already in a wave, what's your invoicing volume, do you need B2B real-time clearance or just B2C reporting, what existing systems does this need to plug into.
2. Fixed quote in SAR within 24 hours.
3. 5–7 days of build: we generate the invoicing system custom-branded for your business, wire up the Fatoora API integration, validate against the ZATCA simulator (sandbox), generate test invoices and verify QR codes scan correctly, and onboard your CSID.
4. Go live with you in the room — we generate your first 5 real invoices together to make sure everything is exactly right before you fly solo.
5. 30 days of free fixes after launch.

You receive a written scope, fixed-price quote, and a clear delivery plan before we start — so you know exactly what you're getting and when.

What to do this week — even if you're not in an active wave yet

• Log into the ZATCA portal and confirm your VAT registration details are current.
• Check your current invoicing setup against the 5 requirements above. Be honest: a "we email PDFs" workflow is not Phase 2 compliant.
• Estimate when your wave will hit. If your VAT-revenue is above SAR 1 million, assume 3–6 months.
• Ask 2–3 vendors for a fixed-price quote to get compliant. Compare actual deliverables, not marketing.
• Pick a path before you receive your wave notification, not after.

The businesses that handle this calmly are the ones that act 6 months ahead. The ones that scramble are the ones that wait for the SMS.