ZATCA Phase-2 Complete Guide: Everything You Need Before the Deadline

ZATCA Phase-2 (Saudi e-invoicing Phase 2) isn't optional — it's a legal mandate rolling out in waves since 2023; wave 25 already reaches businesses with revenue above SAR 187,500 (deadline 1 February 2027). If you haven't yet, this guide saves you weeks of research.

Phase-1 vs Phase-2: What Changed?

Phase-1 (Generation) — December 2021 — was simple: generate an electronic invoice with QR code and UUID, but no real-time submission.

Phase-2 (Integration) — January 2023, rolling out — is fundamentally different:

• Every invoice cryptographically stamped via ZATCA digital certificate
• B2B invoices submitted to ZATCA first (clearance), no print/send before approval
• B2C invoices reported within 24h (reporting)
• Format must be UBL 2.1 XML with ZATCA modifications

Your Compliance Date

ZATCA implements Phase-2 in waves, each wave covering companies above a revenue threshold:

Is your company in any wave? ZATCA sends an official notice 6 months before your activation date.

5 Core Technical Requirements

1. CSID (Cryptographic Stamp Identifier) — digital certificate from ZATCA portal linked to your CR
2. UBL 2.1 XML — approved invoice format with strict metadata
3. QR Code (Base64) — generated with: BR name, VAT, timestamp, total, VAT amount
4. UUID — unique invoice identifier (UUID v4)
5. Hash chain — every invoice's hash links to the previous (immutability)

How Odoo Gets You Compliant

Odoo (version 16 and later) includes the official Saudi e-invoicing module for Phase 2 — and it is open source. With Softloomer as your certified partner, the rollout is:

1. Step 1: Generate CSID from ZATCA portal + upload to Odoo
2. Step 2: Activate ZATCA module + test in sandbox
3. Step 3: Map Account Chart to ZATCA tax codes (15% VAT, 0% exempt, etc.)
4. Step 4: End-to-end testing: B2B clearance + B2C reporting + edge cases
5. Step 5: Production go-live + submissions monitoring

5 Most Common Mistakes

• ❌ Forgetting certificate renewal — CSIDs have an expiry date that must be tracked
• ❌ Wrong tax code mapping (e.g., Zero-rated instead of Exempt)
• ❌ Incorrect hash chain — every invoice must link to previous hash
• ❌ Improper credit note handling (must reference original invoice)
• ❌ No fallback when ZATCA API is down — need a retry queue

What If You Don't Comply?

ZATCA penalties:

• First violation: warning
• Repeat: fines escalate with each repetition, up to SAR 50,000 depending on the violation

The math is clear: a one-time, well-scoped implementation costs far less than repeated fines and the disruption of non-compliance.

Next Step

If your company is in an upcoming wave and you're on Excel or a non-compliant system, book a free 30-min consultation and we'll show you the optimal roadmap.