ZATCA e-invoicing Phase 2: a practical checklist for small businesses

Phase 1, the generation phase, has applied since December 2021. It requires invoices to be created electronically, so handwritten invoices are out, and an invoice cannot be edited or deleted once it is issued. Simplified invoices must also carry a QR code. If you already issue invoices that meet these rules, you have completed Phase 1.

Phase 2, the integration phase, goes further: your invoicing software must connect to ZATCA's Fatoora platform and exchange invoice data with it. It is introduced in waves based on taxpayer revenue, and ZATCA notifies each wave in advance, so the first practical step is to find out whether your business has been notified and when.

Invoices issued to businesses and government entities are standard tax invoices. Under Phase 2 they are cleared: the invoice goes to ZATCA first and is issued to the buyer only after ZATCA accepts it. A wholesale distributor billing shops and companies works this way, so it needs a working connection at the moment it invoices.

Invoices to consumers are simplified tax invoices. They are handed to the customer straight away, as at a cafe counter or a shop till, and then reported to ZATCA within 24 hours. Credit notes and debit notes are e-invoices too, so a refund or a price correction follows the same route as the sale it relates to. Each Phase 2 invoice also has the technical elements below.

• Invoice data as an XML file in the UBL 2.1 format
• A cryptographic stamp that signs each invoice
• A QR code on the invoice
• An invoice counter that numbers invoices in sequence
• The hash of the previous invoice, which links invoices in a chain

Start with facts rather than software. Confirm whether and when ZATCA has notified your business, list the invoice types you issue (standard, simplified, credit and debit notes), and note where invoices are created: a back office, a POS till, a branch. A restaurant and a trading company will end up with very different lists.

Then check your tools. Your invoicing system needs to support Phase 2 specifically, not just the Phase 1 QR code, and someone in your company needs access to the Fatoora portal. Allow time for a full trial run before the date you are required to be live, not after it, and do not wait until the last moment to discover that your software or your account is not ready.

• Confirm your wave and its date from ZATCA's notification
• List every place an invoice is created: office, tills, branches
• Check that your software supports Phase 2 integration, not only the QR code
• Make sure someone in your company can sign in to the Fatoora portal
• Decide who reviews rejected or unsent invoices each day

Onboarding is performed by the taxpayer, not by the software vendor. You generate a one-time password (OTP) in the Fatoora portal and enter it in your invoicing software, which then registers with ZATCA. The result is a set of certificates known as CSID: a compliance certificate used during testing and a production certificate used to sign live invoices.

Because the OTP and the certificates belong to your business, note down who did the onboarding and when. If you issue invoices from several points, such as multiple tills or branches, ask your provider how each one is registered. Fatooraz guides you through the steps inside your workspace, but the OTP itself always comes from your own Fatoora account.

ZATCA provides a simulation environment, separate from production, where you can issue test invoices with no tax effect. Use it to run your real situations: a standard invoice to a company, a simplified invoice at the till, a credit note for a return, a customer whose details are incomplete. Fix gaps in your data now, while a mistake costs nothing.

Involve the people who will do this every day: the cashier, the accountant, whoever sends invoices to customers. Ask them to find where a rejected invoice shows up and what to do next. A Fatooraz trial workspace already runs against the simulation environment, so you can rehearse without issuing a single real invoice, then note down what you noticed so the settings can be corrected before going live.

A frequent mistake is treating an issued invoice as editable. Under e-invoicing rules an issued invoice is not changed or deleted; corrections go through a credit or debit note. Another is forgetting the 24-hour reporting window for simplified invoices when a shop's internet is down for a day, so agree in advance who checks that everything has been reported.

Keep your tax records for the legally required period, generally six years, and confirm the exact requirement with your accountant. Rules, wave dates and technical specifications can change, so check ZATCA's latest announcements and ask your accountant before acting on any guide, including this one, and do not leave these details to memory.