A company whose billing system cannot produce properly signed XML will fail Phase 2 at the technical layer, however compliant its invoicing looks on the surface.

Phase 2 is rolled out in waves by revenue threshold, and ZATCA notifies each group before its compliance date. Waiting for the notification before starting is a common planning error. The notice period is workable but not generous once solution selection, integration development, testing and ZATCA onboarding are sequenced. This builds directly on Phase 1.

Clearance versus reporting

The distinction drives system design. Standard tax invoices (B2B) must be cleared: submitted to ZATCA, validated and returned with a cryptographic stamp before they can legally be given to the buyer. Simplified invoices (B2C) are reported after issue, so the customer receives the invoice immediately and transmission happens afterward. A retail system and a project invoicing system therefore need different integration behavior.

The technical components

A compliant solution must do five things. It generates XML in ZATCA's format and holds the cryptographic stamp identity, the digital credential that stamps each invoice, obtained through Fatoora portal onboarding. It signs each invoice and chains it to the previous one with a hash. It generates the Phase 2 QR code. It handles the API exchange, including error responses and retries. Most businesses meet this through a certified e-invoicing solution integrated to their ERP.

Handling failure properly

The scenario that damages businesses is an outage more than a clean rejection. If ZATCA's platform is unreachable, B2B invoices cannot be cleared, and a business without a queue-and-retry design cannot invoice. We specify offline handling, queuing, automatic retry, alerting and a documented manual procedure, because the question is what happens to your revenue when transmission fails.

A hypothetical example

Consider a contracting company that receives its Phase 2 notification and assumes its ERP vendor will handle it. If the vendor's connector supports reporting but not clearance, it is of little use to a B2B contractor, and a different certified solution would have to be selected, integrated and tested before the compliance date. A readiness review at notification tests this early.

Testing before the compliance date

ZATCA provides a sandbox environment. Thorough testing there against your real invoice types, credit notes, prepayments, multi-line VAT scenarios and foreign currency separates a smooth go-live from an emergency. We test each invoice scenario your business issues instead of a standard sample, and run a parallel period before the mandatory date. Ongoing compliance operation can be handled internally or outsourced once live.

Archival and retention

Cleared and reported invoices must be retained in their signed XML form for the statutory retention period, and a PDF copy is not enough. Businesses that keep only a human-readable copy discover during an audit that they cannot produce the artifact ZATCA expects. We confirm the solution's archival covers the full period, that retrieval is practical, and that the arrangement survives a change of solution provider. This ties into ongoing audit readiness.