ZATCA Phase 2 readiness checklist for Saudi invoicing
Updated 2026-08-01 · 6 min read
Phase 1 of the Saudi programme asked for compliant electronic invoices. Phase 2 asks your systems to talk to the tax authority. The gap between the two is mostly engineering discipline, not accounting knowledge.
The four requirements that trip teams up
Most Phase 2 failures are not exotic. They come from four recurring issues that surface the first time an invoice is validated rather than emailed.
- XML structure: a compliant UBL document, not a PDF with a barcode stapled on
- TLV QR code: tag-length-value encoded, base64, carrying seller name, VAT number, timestamp, total and VAT amount
- Bilingual presentation: Arabic alongside English on the human-readable copy
- Controls: an invoice that has not been internally approved should never be releasable
Getting the QR code right
The QR payload is not free text. Each field is encoded as a tag byte, a length byte and the UTF-8 value, concatenated and base64-encoded. Getting the byte length wrong for Arabic seller names is the single most common defect, because Arabic characters are multi-byte.
Test with a real Arabic legal name, not a placeholder. If your encoder measures string length instead of byte length, it will pass in English and fail in production.
Bilingual invoices are a layout problem
The compliance file is XML, but your customer still receives a document. Saudi buyers expect Arabic labels for the invoice type, party details, line descriptions and totals, rendered right-to-left where appropriate.
Build the bilingual template once, driven from the same canonical record as the XML, so the printed copy and the submitted data can never diverge.
Readiness checklist
Work top to bottom. Any unchecked item is a Phase 2 blocker, not a nice-to-have.
- Every invoice exists as structured data before it is rendered
- Sequential numbering with no manual override path
- Per-line VAT with correct categories for zero-rated and exempt supplies
- TLV QR generated from the invoice record, verified byte-wise with Arabic input
- Arabic/English human-readable copy generated from the same record
- Approval gate: compliance exports blocked until an authorised user approves
- Immutable audit log of every export, with actor, timestamp and format