Saudi Arabia E-Invoicing Requirements 2026: Fatoora Guide

Last reviewed: 6 August 2026

Saudi Arabia requires VAT taxpayers to generate electronic invoices using compliant systems. Larger and selected taxpayers must also integrate their invoicing systems with the Zakat, Tax and Customs Authority’s Fatoora platform under a phased rollout.

This guide explains Saudi Arabia’s e-invoicing requirements for 2026, including who must comply, Phase 1 and Phase 2, current integration waves, invoice formats, clearance, reporting, QR codes, corrections, and electronic storage.

Saudi Arabia e-invoicing requirements at a glance

What is Saudi Arabia’s Fatoora system?

Fatoora is ZATCA’s electronic-invoicing platform. It receives, validates, clears, or reports structured tax invoices and associated credit and debit notes. The system is part of Saudi Arabia’s VAT administration and is intended to create a reliable, tamper-resistant invoice trail.

A scanned paper invoice, image, ordinary PDF, Word document, or spreadsheet is not considered a compliant electronic invoice merely because it is created or sent electronically. The invoice must be generated by a compliant electronic invoice generation solution and contain the required structured data.

Who must use electronic invoicing in Saudi Arabia?

Phase 1 generally applies to:

• resident Saudi VAT-registered taxpayers;
• resident persons who are required to register for VAT; and
• other parties issuing tax invoices on behalf of VAT-registered suppliers.

Non-resident taxable persons are generally excluded from the Saudi e-invoicing regulation. However, a foreign group with a Saudi resident company, branch, or fixed establishment should assess the position of each Saudi registration separately.

Being covered by Phase 1 does not automatically identify a taxpayer’s Phase 2 date. ZATCA selects Phase 2 taxpayers in waves based mainly on revenue subject to VAT and sends direct notice before the integration deadline.

Which transactions are covered?

The rules generally cover transactions for which a Saudi tax invoice or simplified tax invoice must be issued, including:

• standard-rated taxable supplies;
• zero-rated supplies;
• exports of goods or services where a tax invoice is required;
• advance payments connected with taxable supplies; and
• credit and debit notes relating to covered invoices.

ZATCA’s implementation resolution identifies several transactions outside the e-invoicing scope, including fully VAT-exempt supplies, payments for fully exempt supplies, supplies subject to the reverse-charge mechanism, and imports of goods into Saudi Arabia. Other VAT records may still be required for these transactions.

Phase 1: Generation Phase

Phase 1 became enforceable on 4 December 2021. It requires covered taxpayers to stop issuing handwritten invoices or using basic text-editing and spreadsheet programs as invoice-generation systems.

A Phase 1 compliant solution must be able to:

• generate electronic tax invoices and simplified tax invoices;
• generate electronic credit and debit notes;
• include the required invoice fields;
• generate required QR codes;
• protect invoices from alteration or deletion;
• store and retrieve invoices and notes; and
• prevent prohibited functions such as uncontrolled deletion or resetting invoice counters.

Phase 1 does not, by itself, require every taxpayer to connect its system to Fatoora. The live API integration, clearance, reporting, cryptographic controls, and additional structured fields become mandatory when that taxpayer enters Phase 2.

Phase 2: Integration Phase

Phase 2 began on 1 January 2023. It is not applied to every taxpayer at once. ZATCA announces waves and normally notifies targeted taxpayers at least six months before their integration date.

A taxpayer entering Phase 2 must generally:

• integrate each relevant electronic invoice generation solution with Fatoora;
• complete onboarding and obtain cryptographic stamp identifiers;
• generate invoices in the prescribed XML structure;
• include the additional Phase 2 fields;
• use a unique invoice identifier (UUID);
• maintain a hash-linked invoice sequence;
• apply the required cryptographic stamp and QR information;
• clear standard tax invoices before sharing them; and
• report simplified tax invoices within 24 hours.

Each branch, device, cash register, or invoicing unit may require separate onboarding depending on the technical design. Businesses should create an inventory of all systems that generate invoices, not only the central accounting platform.

Saudi e-invoicing waves in 2026

ZATCA uses revenue subject to VAT to determine the integration waves. A threshold is not a general exemption from Phase 1. It only helps identify when selected taxpayers must enter Phase 2.

Wave 25 was announced on 24 July 2026. A taxpayer should not rely only on a public threshold table. Check ZATCA messages, the registered contact details, and the Fatoora portal because the Authority directly notifies targeted taxpayers.

If a business meets the threshold but has not located a notice, it should contact ZATCA rather than assuming the obligation does not apply. Likewise, group revenue, multiple VAT registrations, mergers, and business transfers may require specific analysis.

Standard versus simplified tax invoices

The technical process depends on the invoice type.

Clearance of standard tax invoices

The supplier submits the standard tax invoice XML to Fatoora through the prescribed API. ZATCA validates the file. If it passes, Fatoora applies the required clearance information, including ZATCA’s cryptographic stamp and QR code, and returns the cleared XML.

The seller should not present the final standard tax invoice to the buyer before clearance. If the file fails validation, the seller must correct the errors and resubmit it. Business systems should prevent an uncleared draft from being treated as the final issued invoice.

Reporting simplified tax invoices

A simplified tax invoice is generated by the taxpayer’s compliant solution, cryptographically stamped, and provided to the customer. Its XML must then be reported to Fatoora through the API within 24 hours of generation.

Reporting is not the same as prior clearance. The retail transaction can be completed and the invoice supplied before ZATCA receives the reporting file, but the 24-hour transmission deadline must be monitored.

Required invoice format

Phase 2 invoices use ZATCA’s XML implementation based on UBL. The compliant solution must generate a structured XML invoice. Depending on how the invoice is shared, a taxpayer may also use a human-readable PDF/A-3 with the XML embedded.

A normal PDF without the embedded compliant XML is not the Phase 2 invoice submitted to Fatoora. Similarly, converting a paper invoice into a PDF or image does not make it a compliant e-invoice.

Businesses should use ZATCA’s current XML Implementation Standard, Data Dictionary, Security Features Implementation Standards, and validation tools. Passing a test in the SDK is helpful but does not transfer compliance responsibility from the taxpayer.

QR code requirements

QR codes are an important part of Saudi electronic invoicing. During Phase 1, simplified invoices include the basic required data. Phase 2 expands the QR content using a TLV Base64 structure and security information.

Phase 2 QR data can include:

• seller name;
• seller VAT registration number;
• invoice timestamp;
• invoice total including VAT;
• VAT total;
• hash of the XML invoice;
• cryptographic signature;
• public key; and
• ZATCA signature for standard tax invoices.

The QR code should be generated by compliant software rather than manually assembled by staff. Customers can use ZATCA’s invoice-validation service to scan and inspect supported QR information.

Credit notes, debit notes, and corrections

A final electronic invoice should not be deleted or silently edited. When a correction is required, the supplier should issue an electronic credit note or debit note that refers to the original invoice and explains the adjustment.

During Phase 2, the note follows the clearance or reporting process associated with its document type. Keep the original invoice, the corrective note, Fatoora responses, and the business reason for the change.

If Fatoora rejects a technical submission, correct the underlying problem and resubmit it according to ZATCA’s procedures. A technical rejection is different from a commercial dispute with the customer.

Invoice storage and data security

Taxpayers must preserve electronic invoices, notes, and associated data according to Saudi VAT record-keeping requirements. The system should protect records from unauthorised alteration or deletion and keep them accessible to ZATCA when requested.

A strong archive should contain:

• the original XML invoice or note;
• the human-readable PDF/A-3 where used;
• clearance and reporting responses;
• cryptographic and onboarding information;
• system logs and invoice counters;
• credit and debit notes linked to original invoices; and
• contracts, orders, and delivery evidence supporting the transaction.

Businesses using cloud systems should confirm that storage, accessibility, data location, backup, security, and ZATCA access arrangements meet the applicable rules. Do not assume that Fatoora is a replacement for the taxpayer’s own statutory archive.

Prohibited invoicing-system functions

A compliant system must not allow practices that undermine the invoice trail. Prohibited or restricted functions include:

• uncontrolled deletion or modification of invoices and notes;
• resetting the invoice counter;
• changing timestamps without traceability;
• creating multiple uncontrolled invoice sequences from one solution unit;
• exporting or transferring data without the required protection; and
• generating invoices without required security features.

Software marketing claims are not enough. The taxpayer should test the configured solution, integrations, user permissions, error handling, and audit trail.

Saudi e-invoicing implementation checklist

1. Confirm the VAT registrations and resident entities within scope.
2. Check VAT-subject revenue for every year used in current wave criteria.
3. Review ZATCA notifications and confirm the assigned integration date.
4. List every ERP, point-of-sale system, cash register, branch, and device that creates invoices.
5. Separate standard tax invoices from simplified tax invoices.
6. Configure the current ZATCA XML structure and mandatory fields.
7. Onboard solution units and obtain the required production cryptographic stamp identifiers.
8. Test clearance, reporting, rejection, credit-note, and debit-note scenarios.
9. Prevent standard invoices from being shared before clearance.
10. Monitor the 24-hour reporting deadline for simplified invoices.
11. Protect invoice sequences, counters, hashes, and user access.
12. Archive XML files, responses, and supporting records.
13. Create an incident procedure for system or internet failures and notify ZATCA when required.

Frequently asked questions

Is e-invoicing mandatory in Saudi Arabia?

Yes. Phase 1 has been mandatory since 4 December 2021 for resident VAT taxpayers and other parties issuing invoices on their behalf. Phase 2 applies in ZATCA-announced waves.

What is the latest Saudi e-invoicing wave?

As of 6 August 2026, the latest announced group is Wave 25. It covers taxpayers whose revenue subject to VAT exceeded SAR 187,500 in 2022, 2023, 2024, or 2025, with integration required by 1 February 2027.

Is a PDF a valid Saudi electronic invoice?

A standalone ordinary PDF does not satisfy the Phase 2 structured invoice requirement. The compliant solution generates XML. A PDF/A-3 containing the embedded XML may be used in applicable customer-sharing processes.

What is the difference between clearance and reporting?

Standard tax invoices are submitted to ZATCA and cleared before being sent to the customer. Simplified tax invoices are issued to the customer first and reported to ZATCA within 24 hours.

Do foreign companies have to use Fatoora?

Non-resident taxable persons are generally excluded. A Saudi resident subsidiary, branch, or establishment may still be covered, so foreign groups should review each registration.

Are zero-rated invoices included?

Yes, covered transactions generally include taxable supplies subject to the standard or zero rate. Fully exempt supplies, reverse-charge supplies, and imports of goods are among the transactions identified as outside the e-invoicing scope.

Can an invoice be changed after issuance?

A final invoice should not be deleted or overwritten. Use an electronic credit or debit note that references the original invoice and follows the appropriate Fatoora process.

Does every taxpayer have the same Phase 2 deadline?

No. Phase 2 is implemented in waves based on ZATCA criteria and direct notification. Phase 1 remains applicable even before a taxpayer’s Phase 2 date.

How quickly must a simplified invoice be reported?

The simplified tax invoice XML must generally be reported to Fatoora within 24 hours after it is generated.

Can Excel or Word be used to issue invoices?

Basic spreadsheet and text-editing software do not provide the compliant, tamper-resistant invoice-generation controls required by the Saudi system.

Official Saudi e-invoicing resources

• ZATCA E-Invoicing Portal
• ZATCA E-Invoicing Rollout Phases
• ZATCA Wave 25 Announcement
• E-Invoicing Implementation Resolution
• ZATCA Detailed E-Invoicing Guidelines
• ZATCA E-Invoicing Frequently Asked Questions
• ZATCA Technical Resources for System Developers

Related country guides

• UAE E-Invoicing Requirements
• Singapore InvoiceNow Requirements
• Italy E-Invoicing Requirements
• Spain E-Invoicing Requirements
• Belgium E-Invoicing Requirements