Start a project
Start a project Book a call
Compliance

Saudi e-invoicing (ZATCA): what to ask your developer

The two ZATCA phases, how waves work, standard and simplified invoices, and a list of questions to put to a developer or provider before you sign.

ESTASOFT
11 min read
Cover image for a guide to Saudi e-invoicing and ZATCA, listing phases and waves, standard and simplified invoices, what the system does and questions for a developer.
On this page
    On this page

      In Saudi Arabia, "ZATCA compliant" appears in proposals, contracts and sales pages. It is hard for an owner to test. It can mean the software prints a QR code, or it can mean the software talks to ZATCA's Fatoora platform. Those are different jobs with different costs.

      This guide explains the two phases and the waves in plain words, what ZATCA's technical documents expect of a system, and the questions to put to a developer or provider before you sign. We read ZATCA's pages on 3 November 2026. Some of its PDFs extract badly, and we say where. ESTASOFT has offices in Dubai, Erbil and London and none in Saudi Arabia, so this is advice for a buyer in the Kingdom, whoever you hire.

      The two phases in plain words

      • Generation phase, from 4 December 2021. Taxpayers must generate and store tax invoices and notes with an electronic solution that meets the phase 1 rules. It covers all taxpayers except non-residents, and anyone who issues tax invoices for a VAT-registered supplier. A paper invoice that is copied or scanned is not an e-invoice.
      • Integration phase, from 1 January 2023, in waves. The solution must connect to ZATCA's systems, produce invoices in the required format and add the extra phase 2 fields.

      ZATCA's roll-out page (last updated 1 September 2026) says it tells each group of taxpayers at least six months before its wave. A system built only for the generation phase needs more work when your wave comes. ZATCA announces waves and deadlines on its own pages, and they can change, so confirm each date there before you act.

      Waves: how you find out it is your turn

      ZATCA picks each wave by VAT-subject revenue and says it will notify the targeted taxpayers. These are the waves we read:

      • Wave 22 (announced 21 March 2025): revenue above SAR 1 million in 2022, 2023 or 2024. Connect by 31 December 2025.
      • Wave 24 (26 September 2025): revenue above SAR 375,000 in any of those three years. Connect by 30 June 2026.
      • Wave 25 (24 July 2026): revenue above SAR 187,500 in any of 2022 to 2025. Connect by 1 February 2027.

      ZATCA's news page, updated on 21 October 2026, showed wave 25 as the newest, and we found no wave 26. The thresholds fell with each wave we read, so watch ZATCA's announcements even if you are below today's figure. The roll-out page refers to a wave table, but no table appeared in the text we could read, so we rely on the news pages. Ask your accountant three things: which wave are we in, have we been notified, and who at our company receives ZATCA notices?

      Standard and simplified invoices are two different jobs

      ZATCA separates the tax invoice, usually business to business, from the simplified tax invoice, usually business to consumer. In the integration phase they follow different routes:

      • Standard tax invoice: clearance. The system sends it to ZATCA before the buyer receives it. ZATCA applies its stamp and returns the QR code.
      • Simplified tax invoice: reporting. The seller stamps it, adds its own QR code, shows it to the buyer straight away and reports it to ZATCA within 24 hours.

      The tax invoicing guideline (version 3, May 2026) says a standard invoice is needed for supplies over SAR 1,000, and a simplified one may be issued for supplies below that figure to a customer who is not VAT-registered. It also says invoices must be in Arabic, with other languages as an addition, and with VAT amounts in Saudi riyals. Its text extracts in scrambled order, so check the figures against ZATCA's file. Three more points for your developer:

      • QR code. It is mandatory on simplified invoices, and in phase 2 it carries more data than in phase 1. Customers can scan it with ZATCA's app to see basic invoice details.
      • No edits. An issued invoice cannot be edited or cancelled. You issue a credit note and, if needed, a new invoice. The guideline sets a time limit for notes (section 7.2), so ask your adviser how soon after a return the credit note must go out.
      • Different from the UAE. UAE e-invoices carry no QR code and run through accredited providers. Do not reuse a UAE design here. See UAE e-invoicing for online sellers.

      What the system must be able to do

      The detailed technical guidelines (version 2, November 2022) and the implementation resolution set the rules. In plain words:

      • Onboarding. The business generates a one-time password on the Fatoora portal. The solution creates a certificate request, receives a compliance certificate, submits test documents, and only then receives a production certificate. It must renew that certificate. ZATCA calls these certificates CSIDs.
      • Format and stamp. Documents are XML. Each carries a cryptographic stamp, a unique ID, a counter value and the hash of the previous document, so the invoices form one unbroken chain.
      • One sequence. Each unit keeps a single sequence for standard and simplified documents. A rejected document still uses its place in the chain.
      • Connection. The system sends documents to ZATCA's APIs. The answer is accepted, accepted with warnings, or rejected.
      • Prohibited functions. A solution must not allow anonymous access or default passwords, editing or deleting issued invoices or logs, changing the system clock, resetting the counter, running more than one sequence, or exporting the stamping keys.
      • Failures. The resolution expects you to notify ZATCA of incidents that block invoicing and to catch up promptly once fixed. It also expects invoices to queue while offline.

      The resolution says to issue invoices in XML or in PDF/A-3 with XML embedded, while the technical guideline says documents are submitted as XML. So ask which format goes to ZATCA and which goes to the customer.

      What a developer must be able to show

      Put these in the proposal or the contract, and ask for evidence, not promises.

      1. Your wave and date. Which wave or date is the work built for, and which ZATCA page says so?
      2. A test onboarding. A run through ZATCA's integration sandbox. The developer portal manual (version 3, November 2022) says the sandbox simulates onboarding and submission, and that sandbox results are not ZATCA approval.
      3. Toolbox results. ZATCA offers an SDK that checks generated invoices, credit notes and debit notes. ZATCA says passing does not mean it approved the invoices or release you from responsibility. Ask for results for every document type you use.
      4. Samples. A standard invoice, a simplified invoice with QR code, a credit note and a debit note, each in Arabic.
      5. Edge cases. How the system handles discounts, partial refunds, split shipments, deposits and orders in other currencies.
      6. Rejections. What happens after one, who sees it, and how staff retry without breaking the chain.
      7. Keys and certificates. Where the stamping keys live, who can reach them, who is warned before a certificate expires, and whose name holds them.
      8. Outages. What the system does when ZATCA or the internet is down, and who notifies ZATCA.
      9. Access and logs. Roles, logins and activity logs, and proof that nobody can edit an issued invoice.
      10. Ownership and change. Who owns the code, the keys and the data (see who owns the code), and who updates the system, at what price, when ZATCA changes its specifications.
      11. Responsibility. ZATCA's FAQ (2021) says the taxpayer stays responsible for compliance even when it uses a solution. Ask what the supplier promises in writing.

      Provider or custom build

      ZATCA keeps a Solution Providers Directory. The page calls it indicative and says it is not an approval of any provider's software. Taxpayers may use any solution that meets the requirements, listed or not. The page was last updated on 6 August 2025, so ask a provider which phase it is listed for and for proof that it works with your store or accounting system. The same list applies if you build custom software or connect existing systems through integrations and APIs. Our guide to custom software or off-the-shelf covers that choice, and a Shopify store for Saudi Arabia covers the store side. For a software team, ZATCA's developer pages describe invoice specifications, a data dictionary and security requirements, which are the documents to read first.

      Records, hosting and penalties

      The tax invoicing guideline (version 3, May 2026) says records are kept for at least six years from the end of the tax period, in Arabic and in electronic form inside the Kingdom, where ZATCA can reach them. It allows a central system abroad if the business has a permanent establishment in the Kingdom and can access the records from there. The text is scrambled in places, so ask your adviser whether this applies to you and where your store and software must keep invoice data. This matters when a developer proposes a cloud service outside the Kingdom.

      A ZATCA page dated 16 November 2021 listed e-invoicing fines that start at SAR 5,000 for not issuing e-invoices and SAR 10,000 for deleting or amending an issued one. Some breaches drew a warning first. The page is old, so ask your adviser for the current list.

      What we could not confirm

      • The wave table on the roll-out page, wave 23 and earlier waves, and any wave after 25.
      • The full list of invoice fields. The guideline refers to an annex that was not in the file we read.
      • Whether newer versions replace the November 2022 technical guideline and the May 2023 detailed guidelines.
      • Current penalties.
      • The resolution we read is an unofficial English translation, and the Arabic text prevails.

      This is general information, not legal or tax advice. Check the current rules or ask a qualified adviser before you decide.

      Need a hand?

      If you need invoicing software or a link between your store and your accounting system, ESTASOFT offers custom software and integrations and APIs. Send a short brief on the contact page. We do not give legal or tax advice. If you are also choosing who builds your Saudi website, read hiring a web development company for a Saudi business.

      Sources

      Written by
      ESTASOFT

      Need help with a project?

      Share a short brief. We reply with next steps.

      Start a project Book a call

      Book a call

      30 minutes. Free.

      Tell us about your project and we will suggest a time.

      Send a request

      Or email us at info@estasoft.com

      Cookie preferences

      Necessary

      Needed for the site to work. Always on.

      Always on

      Preferences

      Remember choices such as language and region.

      Analytics

      Help us understand which pages are useful.

      Marketing

      Used to measure and improve campaigns.