Why was e-invoicing introduced in two phases?
Moving from paper invoicing to invoicing connected in real time with the authority is a major change affecting systems, procedures and people. Applying it to all businesses at once would have been a heavy burden, especially for small and medium businesses. So phase one came to standardise the foundation: every invoice must be electronic and protected against tampering. Phase two then came in waves, starting with the largest businesses and moving down gradually. This gave the market and system providers time to prepare, and gave each business advance notice before its deadline.
Phase one: Generation and storage
Phase one took effect on 4 December 2021 for all VAT-registered taxpayers. Its essence is that tax invoices, simplified invoices, credit notes and debit notes must be generated and stored through compliant electronic solutions. Its main requirements included: • Generating invoices electronically from the start, so handwritten or scanned invoices are not accepted. • Storing invoices electronically in a way that preserves their integrity and allows them to be retrieved. • Adding a QR code to simplified tax invoices, carrying basic data such as the seller's name and VAT number, the invoice date, the total and the VAT amount. • Adding certain mandatory fields, such as the buyer's VAT number on tax invoices where applicable. No connection with ZATCA's systems was required at this stage. The focus was on the invoice itself and on the system that issues it.
System controls in phase one
ZATCA did not stop at requiring invoices to be electronic. It set controls to prevent tampering. A compliant solution must not provide the following functions: • Anonymous access, since every user must have their own account and password. • Operating with a default password that is not changed on first use. • Editing or deleting invoices after they are issued. • Resetting the invoice counter. • Creating more than one invoice sequence for the same unit. • Issuing invoices with inaccurate timestamps or allowing the date and time to be changed. Any correction to an issued invoice is made through a credit or debit note that references the original invoice, not by editing the original. This single rule changed how many finance departments work.
Phase two: Integration
Phase two began on 1 January 2023 and is applied in successive waves that ZATCA defines based on VAT-subject revenue, with each business notified at least six months before its deadline. Its essence is that the invoicing system no longer works in isolation from ZATCA. It connects to the FATOORA platform and exchanges invoices with it. Handling differs by invoice type: • A tax invoice, usually issued to businesses, follows the clearance model: it is sent to FATOORA, ZATCA validates it and adds its stamp and QR code, and it is shared with the buyer only after clearance. • A simplified invoice, usually issued to consumers, follows the reporting model: the business's own system stamps it and hands it to the customer immediately, then sends it to ZATCA within 24 hours of issuance.
Technical elements added in phase two
Phase two added technical elements that guarantee the invoice's authenticity and the integrity of its sequence: • A standard format: invoices are generated in XML, or as PDF/A-3 with embedded XML. Tax invoices are submitted for clearance in XML. • A unique identifier (UUID) for each invoice, generated by the system and stored in its file. • A hash that links each invoice to the one before it, so no invoice can be removed from the sequence or reordered without it showing. • A cryptographic stamp that proves the invoice's origin and that its content has not changed. ZATCA adds it to tax invoices during clearance, and the business's system adds it to simplified invoices using its cryptographic stamp identifier (CSID). • An expanded QR code carrying more data than the phase one code. • Protection of the private stamping key so that it cannot be exported from the system.
A quick comparison of the two phases
• Start date: phase one on 4 December 2021 for all registered taxpayers; phase two from 1 January 2023 in waves. • Relationship with ZATCA: no connection in phase one; direct integration with FATOORA in phase two. • Tax invoice: generated and stored electronically in phase one; must be cleared by ZATCA before sharing in phase two. • Simplified invoice: issued with a QR code in phase one; stamped locally and reported within 24 hours in phase two. • Format: any electronic format in phase one; XML or PDF/A-3 with embedded XML in phase two. • Technical elements: no cryptographic stamp, UUID or hash required in phase one; all required in phase two. • Onboarding: no technical onboarding in phase one; each invoicing unit connected through the FATOORA portal with an OTP in phase two.
What does this mean for your business in practice?
If your business issues its invoices from an electronic system that does not allow editing or deletion, it has most likely met phase one. The more important question is readiness for phase two, because it requires: • A system technically capable of integration, clearance, reporting and stamping. • A reliable internet connection at invoicing points, especially for tax invoices that need clearance at the moment of issuance. • Accurate customer and product data, because ZATCA validates the invoice and rejects incomplete ones. • Daily procedures to follow up on rejected and pending invoices and on outages. The earlier your business starts preparing, the easier and cheaper the transition will be.
Frequently asked questions
Did phase one end when phase two began? No. Phase one requirements continue, and phase two is added on top of them rather than replacing them. Does phase two apply to all businesses at the same time? No. It is applied in waves based on revenue, and ZATCA notifies targeted businesses at least six months before their deadline. Does a simplified invoice need a constant internet connection? It does not need real-time clearance, but it must be reported within 24 hours, so the system needs regular connectivity. Can a tax invoice be shared with the customer before it is cleared? As a rule it is shared after clearance, and ZATCA's guidelines set out special procedures for cases where clearance is not possible because systems are down.
Conclusion
Phase one made the invoice electronic and protected against tampering, and phase two connected it to ZATCA and secured it technically. Knowing where your business stands between the two phases is the starting point for any realistic compliance plan. At Shams Solutions, we help businesses prepare their accounting and ERP systems for e-invoicing, from the initial assessment and data cleanup to integration with the FATOORA platform, go-live and ongoing follow-up. Contact us to review your business's setup and agree on the right next steps.