What Are the Requirements for E‑invoicing in Saudi Arabia (2026): Clearance Model, File Formats, QR Codes & Phase 2 Deadlines

Understanding what are the requirements for e-invoicing in Saudi Arabia is now a frontline compliance priority for every VAT-registered business operating in the Kingdom. The Zakat, Tax and Customs Authority (ZATCA) has moved beyond the generation phase (Phase 1) and is actively rolling out Phase 2, the integration phase, in successive waves throughout 2024, 2025 and 2026, with further deadlines falling as late as June 2026. Phase 2 mandates real-time clearance of tax invoices through ZATCA’s Fatoora platform, requires invoices to be produced in a structured XML format (with PDF/A‑3 embedding for human-readable copies), and tightens QR code obligations for simplified invoices. For finance directors, compliance officers and ERP teams, the window for technical preparation is narrowing rapidly.

Quick Summary, What Businesses Must Decide Now

Before diving into the technical detail, every affected taxpayer should confirm six immediate actions to stay ahead of the ZATCA e‑invoicing Phase 2 requirements:

1. Confirm VAT registration status. Verify your current registration and check whether ZATCA has issued a wave-specific notification to your organisation.
2. Map your invoice flows. Identify which transactions produce standard tax invoices (B2B) and which produce simplified tax invoices (B2C), because the clearance and QR code obligations differ.
3. Audit ERP XML export capability. Confirm that your accounting or ERP system can generate invoices in ZATCA’s required UBL 2.1–based XML schema.
4. Implement PDF/A‑3 embedding. Ensure the human-readable PDF version of each invoice embeds the XML data file as an attachment, conforming to the PDF/A‑3 standard.
5. Enable QR code generation. Build or activate QR code functionality that encodes the minimum data fields prescribed by ZATCA for simplified invoices.
6. Test API clearance in the sandbox. Register on the Fatoora portal, obtain your cryptographic stamp, and complete end-to-end testing before your wave deadline arrives.

Industry observers expect that businesses delaying these steps until the final weeks before their wave deadline will face significant operational disruption, because ZATCA’s sandbox and onboarding processes require lead time for certificate issuance and technical validation.

Scope and Who Is Required to Issue E‑Invoices in Saudi Arabia

VAT-Registered Persons

ZATCA’s e‑invoicing regulations apply to all taxpayers who are resident in Saudi Arabia and registered for VAT. This includes companies, partnerships, sole proprietorships and any other legal entity that holds an active VAT registration with ZATCA. From Phase 1, these taxpayers were required to generate invoices electronically through a compliant solution rather than handwriting or scanning paper invoices. Under Phase 2, the obligation expands to integrate those solutions directly with ZATCA’s platform for real-time or near-real-time validation.

Non-Resident Suppliers, Agents and Marketplaces

Non-resident suppliers who are VAT-registered in Saudi Arabia through a tax representative are also in scope. Digital-platform operators and marketplace facilitators that are deemed to be the supplier for VAT purposes must issue e‑invoices on behalf of underlying sellers. Third-party agents issuing invoices on a principal’s behalf must ensure that the invoices meet all technical specifications and are cleared through the principal’s Fatoora integration.

The Clearance Model, How ZATCA Validates E‑Invoices in Saudi Arabia

The centrepiece of ZATCA e‑invoicing Phase 2 is the clearance model. Unlike a post-audit or periodic-reporting model, the clearance model requires that every standard (B2B) tax invoice is submitted to ZATCA’s Fatoora platform for validation before the invoice is shared with the buyer. The invoice is not considered legally valid until ZATCA returns a clearance response containing a cryptographic stamp and a unique invoice reference number. For simplified (B2C) tax invoices, the model operates on a reporting basis, invoices are transmitted to ZATCA within 24 hours of issuance but do not require pre-clearance before delivery to the customer.

This distinction is critical for system design: B2B flows must be synchronous (or near-synchronous) with ZATCA’s API, while B2C flows can be batched within the reporting window. According to ZATCA’s e‑invoicing guidelines, the platform validates the invoice’s XML structure, mandatory fields, tax calculations, and the taxpayer’s cryptographic stamp identity before returning a clearance or rejection status.

Process Flow: ERP → XML → ZATCA API → Clearance Token → PDF Delivery

The practical implication is that any delay or rejection at step 4 blocks the entire invoicing workflow. Businesses must therefore build retry logic, error-handling queues and monitoring dashboards into their ERP integration layer to avoid revenue-recognition bottlenecks.

File Formats for E‑Invoicing in Saudi Arabia: XML Schema and PDF/A‑3 Embedding

ZATCA’s e‑invoicing guidelines specify two interrelated file formats that together form a compliant electronic invoice: a structured XML data file and a PDF/A‑3 visual representation that embeds the XML as an attachment.

XML Requirements

The XML schema is based on the Universal Business Language (UBL) 2.1 standard, customised by ZATCA for Saudi Arabia’s VAT and tax-invoice requirements. Key technical specifications include UTF-8 character encoding, use of ZATCA-defined namespaces, and compliance with the field structure set out in the Detailed Guidelines for E‑Invoicing. Every XML file must include a digital signature block containing the taxpayer’s cryptographic stamp and, after clearance, the ZATCA-issued QR code data and invoice hash.

PDF/A‑3 Embedding, Tools and Validation

The PDF/A‑3 standard allows binary attachments inside a PDF file, which is how the XML data file is packaged for human-readable distribution. The cleared XML must be embedded as an associated file within the PDF/A‑3, ensuring that both the visual invoice and the machine-readable data travel as a single document. Common approaches to PDF/A‑3 generation include using ERP-native report designers (SAP, Oracle) with PDF/A‑3 output profiles, open-source libraries such as Apache PDFBox, or ZATCA-certified middleware solutions. After generation, businesses should validate the output against a PDF/A‑3 conformance checker to confirm that the embedded XML is intact, the document metadata is correct, and fonts are fully embedded as required by the standard.

This dual-format approach, XML for machine processing, PDF/A‑3 for human readability, is central to the requirements for e-invoicing in Saudi Arabia and distinguishes the Kingdom’s model from jurisdictions that accept only one format.

Mandatory Invoice Fields and QR Code Rules for Tax Invoices in Saudi Arabia

Every tax invoice issued in Saudi Arabia must contain a defined set of mandatory fields, whether it is a standard (B2B) invoice or a simplified (B2C) invoice. ZATCA’s Detailed Guidelines enumerate these fields precisely, and any omission will trigger a rejection at the clearance stage.

The core mandatory fields include:

• Seller information. Legal name, address and VAT registration number (TIN).
• Buyer information. For standard invoices: legal name, address and VAT number. For simplified invoices: buyer details are not required unless the invoice exceeds SAR 1,000.
• Invoice identifiers. Sequential invoice number, issue date, issue time, and invoice type code.
• Line items. Description of goods or services, quantity, unit price (exclusive of VAT), applicable VAT rate and VAT amount per line.
• Totals. Taxable amount, total VAT, total amount payable, and currency code (SAR).
• Cryptographic stamp. Digital signature applied by the taxpayer’s compliant e‑invoicing solution.
• QR code. Mandatory on all simplified (B2C) invoices; encoded within standard invoices after clearance.

The QR code must encode a minimum set of data fields using a TLV (Tag-Length-Value) structure. According to ZATCA e‑invoicing guidelines, the required QR code payload fields are:

1. Seller’s name
2. Seller’s VAT registration number
3. Invoice date and time (timestamp)
4. Invoice total (with VAT)
5. Total VAT amount

For Phase 2 invoices, the QR code must additionally include the XML invoice hash and the ZATCA cryptographic stamp identifier. The QR code must be printed on any physical copy of a simplified invoice and embedded within the electronic PDF. ZATCA does not prescribe a minimum pixel size but recommends that the code remain scannable at the printed output resolution. Businesses should test QR readability across their standard print formats (thermal receipt printers, A4 laser printers) during the sandbox phase.

ZATCA E‑Invoicing Phase 2 Waves and Deadlines: Timeline for 2024–2026

ZATCA is implementing the Phase 2 integration requirement in successive waves, each targeting taxpayers based on annual taxable revenue thresholds as reported in VAT returns. Businesses receive individual notifications from ZATCA at least six months before their wave’s go-live date. The ZATCA e‑invoicing waves announced through 2026 follow this general structure:

The ZATCA e‑invoicing Phase 2 deadline for each business is set by the individual notification letter, and ZATCA has been progressively lowering the revenue threshold with each wave. Early indications suggest that mid-market and smaller VAT registrants will receive their notifications throughout the first half of 2026, with integration deadlines falling between March and June 2026. Missing the deadline exposes businesses to penalties and may affect the legal validity of invoices issued without clearance.

Reporting Obligations by Entity Type

Implementation Checklist for E‑Invoicing in Saudi Arabia: ERP Mapping, API Integration and Testing

A structured implementation roadmap is essential to meet the ZATCA e‑invoicing requirements on time. The following checklist breaks the project into five workstreams.

Business Readiness

• Confirm your organisation’s wave assignment by checking for ZATCA notification letters.
• Appoint a project owner (finance + IT) and establish a cross-functional steering committee.
• Map all invoice types: standard tax invoices, simplified tax invoices, credit notes and debit notes.
• Review master data: supplier and customer VAT numbers, addresses, item tax codes and unit-of-measure mappings.

ERP Mapping and SKU/Tax Code Configuration

• Map each ERP invoice field to the corresponding UBL 2.1 XML node defined in the ZATCA schema.
• Configure tax-code logic so that the correct VAT rate (15 %, 0 %, exempt) is applied and accurately reflected in the XML output.
• Establish a sequential, tamper-resistant invoice numbering series that meets ZATCA’s uniqueness requirement.

API Authentication and Certificate Handling

• Register on the Fatoora portal and generate your Cryptographic Stamp Identifier (CSID) for your e‑invoicing solution.
• Store certificates securely using a hardware security module (HSM) or equivalent key-management service.
• Implement OAuth 2.0 client-credential flows (or the authentication method specified by ZATCA’s API documentation) for automated API calls.

Sandbox Testing

• Submit test invoices through ZATCA’s sandbox environment covering all invoice types and edge cases (multi-line, zero-rated, exempt, credit notes).
• Validate that clearance tokens are returned correctly and that rejection error codes are captured and logged.
• Confirm PDF/A‑3 output: verify XML embedding, QR code rendering and print-format readability.
• Establish acceptance criteria, for example, 100 % clearance success rate on a defined test-case set before moving to production.

Fatoora Portal Onboarding and Full Rollout

• Transition from sandbox to production CSID upon successful testing.
• Run a parallel period where invoices are generated in both old and new formats to confirm data integrity.
• Train accounts-receivable, finance and customer-service teams on new workflows, error-handling procedures and buyer communication protocols.
• Document all configurations, mappings and test results for audit-trail purposes.

Controls, Recordkeeping and Penalties

ZATCA requires that all e‑invoices and associated data (XML files, clearance tokens, API logs) be retained for a minimum period aligned with the VAT law’s record-retention requirement, generally six years from the end of the tax period to which the invoice relates. Businesses should implement automated archiving with tamper-evident storage, maintain a complete audit trail of every invoice submission and ZATCA response, and perform periodic reconciliations between ERP records and Fatoora platform logs.

Penalties for non-compliance with e‑invoicing rules range from written warnings for first-time procedural failures to financial penalties that can reach SAR 50,000 per violation for repeated or material breaches. ZATCA has the authority to escalate enforcement actions, including restricting a taxpayer’s ability to issue invoices through the platform. The likely practical effect of stricter Phase 2 enforcement will be that invoices issued outside the clearance model are treated as non-compliant documents, potentially jeopardising VAT-input deductions for the buyer.

Conclusion

The requirements for e-invoicing in Saudi Arabia under ZATCA’s Phase 2 integration model represent one of the most technically demanding tax-compliance obligations in the region. Businesses that have not yet confirmed their wave assignment, validated their XML output, tested API clearance in the sandbox, or implemented PDF/A‑3 embedding and QR code generation should treat this as an urgent priority, particularly with integration deadlines continuing to fall throughout the first half of 2026. A structured compliance audit covering ERP readiness, data-field mapping, certificate management and internal controls is the most effective way to avoid penalties and ensure that every invoice issued carries full legal validity.

Professional accounting and tax advisory support can accelerate this process and reduce the risk of costly implementation errors.

Last reviewed: 23 May 2026. This article should be revisited within 60 days of any new ZATCA announcement regarding additional Phase 2 waves or technical specification updates.

Sources

1. ZATCA, Detailed Guidelines for E‑Invoicing Version 2 (PDF)
2. ZATCA, What is e‑invoicing (overview page)
3. ZATCA, E‑Invoicing main page
4. EDICOM, Mandatory Electronic Invoicing in Saudi Arabia
5. ClearTax, KSA e‑invoicing step-by-step guide
6. VATCalc, e‑invoicing wave & QR code commentary
7. Comarch, E‑Invoicing in Saudi Arabia
8. Fonoa, Saudi Arabia e‑invoicing and digital reporting
9. Tally Solutions, FAQs on e‑invoicing in Saudi Arabia