ZATCA E-Invoicing Phase 2 in 2026: The Complete Saudi Compliance Checklist
2026-09-22 — EMM Team — ZATCA, Fatoorah, E-invoicing, Phase 2, Saudi Arabia, Compliance
ZATCA's e-invoicing program (Fatoorah) has moved through its waves steadily since 2023, and by 2026 the Integration Phase — Phase 2 — applies to essentially every VAT-registered business in the Kingdom, including the smallest taxpayers that were once exempt. If your invoices are still generated by a standalone tool that does not talk to ZATCA's platform, you are now out of compliance, and penalties reach SAR 1,000 per invoice in repeated cases.
Phase 1 vs Phase 2 in one minute
- Phase 1 (Generation): issue invoices from any compliant system, with the required fields and QR code. No connection to ZATCA required.
- Phase 2 (Integration): your invoicing solution must connect to ZATCA's platform, report invoices in real time (standard invoices, B2B) or within 24 hours (simplified invoices, B2C), and pass validation against ZATCA's XML rules.
The 2026 compliance checklist
- 1. Solution onboarding: your e-invoicing solution must be listed among ZATCA's approved solutions. If you build in-house, it must pass ZATCA's onboarding simulation tests before production.
- 2. XML invoice format: invoices must follow the UBL 2.1 XML standard with ZATCA's specific extensions (ICV counter, invoice hash chain, cryptographic stamp).
- 3. QR code: TLV-base64 encoded, containing the seller and buyer data, timestamp, total, VAT, and the cryptographic signature.
- 4. Hash chaining: each invoice includes the hash of the previous invoice — tamper-evident by design.
- 5. Archiving: invoices and any modifications must be archived inside Saudi Arabia for at least 6 years, readable without your vendor's proprietary software.
- 6. Credit/debit notes: the same rules apply to notes referencing the original invoice, including the PIH (previous invoice hash).
- 7. Clearance vs reporting: standard B2B invoices are cleared before sharing with the buyer; simplified B2C invoices are reported after issuance within 24 hours.
Most penalty notices we see are not about fraud — they are about XML validation failures: missing mandatory fields, wrong VAT category codes, or a broken hash chain. These are engineering problems with engineering fixes.
How EMM helps
EMM Technology Solutions helps Riyadh businesses integrate their ERP, POS, or custom systems with ZATCA's platform: XML generation and validation, cryptographic stamping, onboarding simulations, and archive architecture that keeps you compliant without slowing your operations. If you are automating the rest of your back office too, start with our guide on why automation is key for SMEs and our walkthrough of Fatoorah fundamentals.