How to Comply with ZATCA Phase 1: Generation Phase Setup (2026)

To comply with ZATCA Phase 1, every VAT-registered Saudi taxpayer must issue invoices from a compliant Phase 1 EGS: structured XML payload, tamper-resistant storage, sequential numbering with no gaps, immutable record retention for six years, and a Base64-encoded TLV QR on every Simplified Tax Invoice (B2C). Phase 1 has no portal submission and no signing certificate — those are Phase 2.

Macro context — why Phase 1 exists

Phase 1 is the foundational layer ZATCA put under every VAT-registered business so that Phase 2 (the CTC clearance layer) could be rolled out wave-by-wave without anyone still issuing handwritten invoices.

Phase 1 is the foundational layer ZATCA put under every VAT-registered business so that Phase 2 (the CTC clearance layer) could be rolled out wave-by-wave without anyone still issuing handwritten invoices. Functionally it is a "structured-invoice mandate without transport" — closer to France's pre-2026 e-invoicing prep than to a clearance regime. The rules are simpler than Phase 2 but the controls are real, and the penalty schedule is shared with Phase 2.

What Phase 1 requires

Invoices generated in a structured electronic format (XML, or a system that stores the structured payload alongside a PDF/A-3 rendering). Handwritten and editable spreadsheet "invoices" are non-compliant.

• Invoices generated in a structured electronic format (XML, or a system that stores the structured payload alongside a PDF/A-3 rendering). Handwritten and editable spreadsheet "invoices" are non-compliant.
• The system must be tamper-resistant: issued invoices cannot be edited or deleted; corrections happen through linked credit and debit notes.
• Sequential numbering per Solution Unit, no gaps.
• A TLV QR on every Simplified Tax Invoice (B2C) containing the five mandatory tags.
• Records retained for six years in immutable storage.

Implementation steps

Step 1 — Lock down sequential numbering

Allocate the invoice number atomically when the invoice is finalised. Do not derive it from a database row ID, do not allow user-entered numbers, and never skip a number — gaps are an audit red flag and the most common Phase 1 finding in ZATCA inspections.

Step 2 — Make issued invoices immutable

Once issued, the record (XML payload, totals, line items, timestamp) must be append-only. Corrections happen through linked credit and debit notes that reference the original invoice's UUID. Both documents stay in the audit trail.

Step 3 — Generate the TLV QR for B2C invoices

For every Simplified Tax Invoice, embed the Base64-encoded TLV QR in both the PDF and (where supported) the XML. Specification below.

Step 4 — Store the hash chain even though Phase 1 does not require it

Phase 1 does not enforce a previous-invoice-hash (PIH) chain, but Phase 2 does. Compute and persist it from day one so that on your Phase 2 wave you are not retro-fitting the chain onto historical records.

Step 5 — Retain in immutable storage

The XML, the PDF/A-3 rendering, and the QR must be retained for six years in storage that prevents deletion or alteration. Cloud object storage with versioning plus object-lock is the standard pattern; on-premise archives must use WORM (write-once-read-many) media.

The TLV QR — the only piece of cryptography in Phase 1

The Simplified Tax Invoice QR uses TLV (Tag-Length-Value) encoding, base64-wrapped.

The Simplified Tax Invoice QR uses TLV (Tag-Length-Value) encoding, base64-wrapped. Phase 1 requires five tags:

1. Tag 1 — Seller name (UTF-8).
2. Tag 2 — VAT registration number (15 digits, ends in 03).
3. Tag 3 — Invoice timestamp (ISO-8601 with timezone, e.g. 2026-06-23T10:15:00+03:00).
4. Tag 4 — Invoice total including VAT.
5. Tag 5 — VAT amount.

The length byte must be computed on the UTF-8 byte array, not on string length — a frequent bug with Arabic seller names where one character is typically two bytes.

Build Phase 2-ready from day one

When ZATCA calls your wave for the Integration Phase, you typically have six months to integrate. The transition is dramatically easier from a well-configured Phase 1 setup.

When ZATCA calls your wave for the Integration Phase, you typically have six months to integrate. The transition is dramatically easier from a well-configured Phase 1 setup. Two non-required but high-leverage additions:

• Compute and persist the PIH chain in Phase 1. Phase 2 needs it; retrofitting it across historical invoices is painful.
• Use UBL 2.1 as the structured payload now. Even if you render only PDF in Phase 1, persist the UBL XML alongside — Phase 2 mandates exactly that schema.

For the full delta, see ZATCA Phase 1 vs Phase 2; the Phase 2 implementation guide is here.

Compliance checklist

Compliance checklist includes: ☐ Invoices issued from a structured-format system (UBL 2. 1 recommended).

• ☐ Invoices issued from a structured-format system (UBL 2.1 recommended).
• ☐ Sequential numbering, allocated atomically, no gaps.
• ☐ Tamper-resistance: issued invoices cannot be edited or deleted, only reversed via credit notes.
• ☐ TLV QR on every Simplified Tax Invoice, length bytes computed on UTF-8.
• ☐ Six-year archive in object-locked / WORM storage.
• ☐ PIH chain optional-but-stored (Phase 2-ready).
• ☐ UBL 2.1 XML persisted alongside the PDF (Phase 2-ready).

Key takeaways

Key takeaways includes: Phase 1 is about structure, sequence, immutability, and a five-tag QR — not signing or transport. The penalty schedule is shared with Phase 2; missing QR on a B2C invoice still triggers fines.

• Phase 1 is about structure, sequence, immutability, and a five-tag QR — not signing or transport.
• The penalty schedule is shared with Phase 2; missing QR on a B2C invoice still triggers fines.
• Doing Phase 1 properly (UBL 2.1 + PIH chain stored) cuts Phase 2 onboarding from weeks to days.

Authority sources

• ZATCA — Phase 1 Simplified Guide (PDF)
• ZATCA — TLV QR Code Creation guide (PDF)
• ZATCA — Roll-out phases
• ZATCA — E-invoicing FAQ (PDF)
• ZATCA — Simplified Technical Guide

Want a system that already enforces all of the above and migrates you to Phase 2 in place? See Invoicemonk for ZATCA Phase 1.