Saudi Arabia: ZATCA, its phases and its waves

Station one established that Saudi Arabia chose the clearance model. This station sets it out.

The legislation itself is covered in ZATCA phase two. This station is about something else: what your system has to do, by when, and who owns each step.

The two phases

Phase one — generation — began on 4 December 2021. The authority’s own wording is clear about what it banned: handwritten invoices and invoices produced in text editors or spreadsheet software, with invoices generated and stored carrying the required fields including the QR code.

Phase one killed the spreadsheet invoice. That alone pushed a wide band of businesses out of how they had always worked.

Phase two — integration — adds three things: connecting your invoicing solution to the Fatoora platform, issuing invoices in a specified format, and carrying additional fields.

The waves, and where they have reached

Phase two applies in waves, by VAT-subject revenue.

Wave	Threshold	Integration date
23	Revenue above SAR 750,000	—
24	Revenue above SAR 375,000	30 June 2026
25	Revenue above SAR 187,500	1 February 2027

Wave 25 was announced on 24 July 2026 and covers every taxpayer whose VAT-subject revenue exceeded SAR 187,500 during 2022, 2023, 2024 or 2025.

Read that last figure carefully. SAR 187,500 is the voluntary VAT registration threshold itself. The wave has reached the floor of the registered population, and there is nobody left beneath it.

The practical consequence: anybody who assumed they were too small is no longer too small. Waiting for a wave that excludes you is waiting for something that no longer exists.

The six-month rule — which is your project schedule

The authority states that it notifies subsequent waves directly, at least six months before their integration date.

That is the most operationally important sentence on this page, and it reads two ways.

• Reassurance: you will not be ambushed. The minimum notice is published.
• Warning: six months is all you get. Ample for somebody whose data is in order, and very tight for somebody who discovers at that point that half their customers have no tax registration number in the system.

So the practical rule is: do not wait for the notice. Start station six today, because that is the work that consumes all six months if it starts with them.

The two invoice types — an operational difference, not a cosmetic one

	Tax invoice	Simplified invoice
For whom	Business to business or government	Business to consumer
The route	Cleared in advance — approved before it reaches the buyer	Reported afterwards, within 24 hours
Effect of an outage	You cannot issue an approved one	It is issued, and reported later

That last row is what has to reach your management.

A business selling to companies under the clearance model stops issuing approved sales when connectivity fails. A retailer selling to consumers keeps selling and reports later.

So write your outage procedure for your invoice mix, rather than for what a generic guide described.

What your system has to do

Without the technical detail — that is station five — your system needs to:

1. Produce the document in the approved format with all of its fields.
2. Stamp it and chain it so that deletion is detectable.
3. Connect to the platform with a certificate issued per issuing unit.
4. Handle rejection: read the error, fix it, resubmit — which is always neglected, and is station nine.
5. Archive so that the original document can be produced on request.

What integration day actually involves

“Integration” is not a moment. It is a sequence of three steps, run per issuing unit.

Step	What you do	Where it usually stalls
1. Onboarding request	Request an onboarding code for the issuing unit	Account permissions on the authority’s portal
2. Compliance certificate	Your solution submits samples and passes compliance checks	Missing fields in the samples
3. Production certificate	The live issuing certificate is granted and real submission starts	Its later expiry, with no warning

And an issuing unit is not the company. It may be a branch, a point-of-sale device or an invoicing stream. A company with twenty branches may need twenty onboardings and twenty certificates — each with an expiry date.

Step two is what exposes your real readiness, because it is the first time an external party judges your documents. Arrive there with incomplete data and you sit for weeks — which is exactly what station six prevents.

What you actually do in this station

• Identify your wave: review your VAT-subject revenue across the four years against the thresholds above.
• Look for the authority’s notice in the official contact channels registered with it. Anybody who has not updated their registered email may never receive it.
• Write your integration date, subtract six months, and make the result your project start.
• Classify your invoices: how many tax, how many simplified? The ratio sets the size of your outage exposure.
• Write the outage procedure and have management sign it, not IT.

The three commonest mistakes

One: assuming small means exempt. The threshold fell to SAR 187,500, and nobody is left below it.

Two: waiting for the notice before starting. The six months then go into data cleaning that could have happened at any time.

Three: treating tax and simplified invoices alike. One outage procedure gets written that suits neither.

The acceptance test for this station

1. State what phase one banned, specifically.
2. State your wave, its threshold and your integration date.
3. Explain the six-month rule in both of its readings.
4. Separate tax from simplified invoices by route and by outage effect.
5. Show the outage procedure you wrote and who signed it.

What comes next

Move to the market whose deadlines are closer than any other in the region right now: the UAE — the model and the deadlines. If you invoice in the UAE, that station is urgent in the literal sense.