A company in KAFD whose billing system doesn't produce properly signed XML is failing Phase 2 at the technical layer, regardless of how compliant its invoicing looks on the surface.

Phase 2 is being rolled out in waves by revenue threshold, with ZATCA notifying each group at least six months before its compliance date. Waiting for the notification before starting is the single most common planning error, because six months is a workable but not generous window once solution selection, integration development, testing and ZATCA onboarding are all sequenced. This builds directly on Phase 1.

Clearance versus reporting

The distinction drives system design. Standard tax invoices, B2B, must be cleared: submitted to ZATCA, validated and returned with a cryptographic stamp before they can legally be given to the buyer. Simplified invoices, B2C, are reported within twenty-four hours of issue, so the customer receives the invoice immediately and transmission happens afterward. A retail system and a project invoicing system therefore need genuinely different integration behavior.

The technical components

Compliance requires a solution that generates XML in ZATCA's specified format, holds a cryptographic stamp identity obtained through the Fatoora portal onboarding process, applies digital signatures and hashes with each invoice chained to the previous one, generates the Phase 2 QR code, and handles the API exchange including error responses and retries. Most businesses meet this through a certified e-invoicing solution integrated to their ERP rather than building it themselves.

Handling failure properly

The scenario that damages businesses is not a clean rejection but an outage. If ZATCA's platform is unreachable, B2B invoices cannot be cleared, and a business without a queue-and-retry design simply cannot invoice. We specify offline handling, queuing, automatic retry, alerting and a documented manual procedure, because the question is not whether transmission will occasionally fail but what happens to your revenue when it does.

A common Saudi scenario

A Riyadh contracting company receives its Phase 2 notification and assumes its ERP vendor will handle it. Three months in, it emerges the vendor's connector supports reporting but not clearance, which is useless for a B2B contractor. With ten weeks left, a different certified solution has to be selected, integrated and tested. The project succeeds but at considerable cost and stress, all of which a proper readiness review at notification would have avoided.

Testing before the compliance date

ZATCA provides a sandbox environment, and thorough testing there against your real invoice types, credit notes, prepayments, multi-line VAT scenarios, foreign currency, is what separates a smooth go-live from an emergency. We test each invoice scenario your business actually issues, not just a standard sample, and run a parallel period before the mandatory date. Ongoing compliance operation can be handled internally or outsourced once live.

Archival and the six-year obligation

Cleared and reported invoices must be retained in their signed XML form, not merely as PDFs, for the statutory retention period. Businesses that keep only a human-readable copy discover during an audit that they cannot produce the artifact ZATCA actually expects. We confirm the solution's archival covers the full period, that retrieval is practical rather than theoretical, and that the arrangement survives a change of solution provider, which ties into ongoing audit readiness.

Local context

High-volume Riyadh retailers must prioritize throughput and reliable twenty-four hour reporting.