ZATCA Phase 1 Explained: The Saudi Generation Phase (2026)

ZATCA Phase 1 — the Generation Phase of Saudi Arabia's Fatoorah programme — has been in force since 4 December 2021. It requires every VAT-registered resident to issue invoices from a structured, tamper-resistant electronic system with sequential numbering and (for B2C) a TLV QR. It does not require cryptographic signing, certificates, or real-time submission to ZATCA — those are Phase 2.

Macro context — Phase 1 is a structured-invoice mandate without transport

Globally, e-invoicing mandates fall into two macro categories: structured-invoice mandates (require a specific format and controls, no transport — e.

Globally, e-invoicing mandates fall into two macro categories: structured-invoice mandates (require a specific format and controls, no transport — e.g. France pre-2026, Australia, UK MTD's structured-record requirement) and CTC clearance/reporting mandates (add a state-operated transport — e.g. Italy SdI, India IRP, ZATCA Phase 2). Phase 1 is the former. ZATCA used it as the prerequisite layer for Phase 2: get every VAT-registered business onto a compliant electronic system first, then add the cryptographic and transport layer.

What Phase 1 requires

Every VAT-registered business in Saudi Arabia must:

Every VAT-registered business in Saudi Arabia must:

• Generate invoices in a structured electronic format using a compliant system. Handwritten invoices and editable spreadsheets are non-compliant.
• Operate a tamper-resistant system — once an invoice is issued, it cannot be edited or deleted, only reversed via credit notes.
• Allocate sequential invoice numbers with no gaps.
• Embed a QR code on Simplified Tax Invoices (B2C), with seller name, VAT number, timestamp, total with VAT, and VAT amount encoded as Base64 TLV.
• Retain records in immutable storage for six years.

What Phase 1 does not require

No CSID or XAdES signature (introduced in Phase 2). No real-time submission to ZATCA (no clearance, no 24-hour reporting).

• No CSID or XAdES signature (introduced in Phase 2).
• No real-time submission to ZATCA (no clearance, no 24-hour reporting).
• No invoice hash chain (recommended for forward compatibility, but not enforced).
• No QR on Standard Tax Invoices (B2B) — that becomes mandatory in Phase 2.

Who is in scope?

All resident VAT-registered persons in Saudi Arabia, plus any party issuing tax invoices on their behalf. Non-resident sellers without a Saudi VAT registration are out of scope.

All resident VAT-registered persons in Saudi Arabia, plus any party issuing tax invoices on their behalf. Non-resident sellers without a Saudi VAT registration are out of scope. Once your wave is called for the Phase 2 Integration Phase, the Phase 2 rules supersede Phase 1 for that Solution Unit, but the Phase 1 controls remain preconditions.

Why Phase 1 exists

Phase 1 is the baseline that made Phase 2 possible.

Phase 1 is the baseline that made Phase 2 possible. It forced every VAT-registered business onto a compliant electronic system, which in turn made the rollout of cryptographic signing and real-time clearance technically feasible. If a business skipped Phase 1 controls, Phase 2 onboarding becomes painful — there is no compliant payload to sign, no sequential numbering to chain, and no immutable archive to point at during an audit.

Penalties

The penalty schedule under the e-invoicing regulation applies in both phases.

The penalty schedule under the e-invoicing regulation applies in both phases. Common Phase 1 fines:

• Missing QR on a B2C Simplified Tax Invoice: warning, then SAR 1,000 – SAR 5,000.
• Editable system that cannot prove immutability: warning, then SAR 5,000 – SAR 10,000.
• Deletion or alteration of an issued invoice: up to SAR 50,000.
• Failure to retain records for six years: up to SAR 50,000.

The most common Phase 1 breach in ZATCA field inspections is editable spreadsheet "systems" that cannot prove tamper-resistance.

When does Phase 2 take over?

ZATCA notifies each taxpayer wave individually with a six-month integration window. The wave criteria have stepped down from prior-year VATable revenue ≥ SAR 3 bn (Wave 1, January 2023) to small businesses with revenue around SAR 2.

ZATCA notifies each taxpayer wave individually with a six-month integration window. The wave criteria have stepped down from prior-year VATable revenue ≥ SAR 3 bn (Wave 1, January 2023) to small businesses with revenue around SAR 2.5 m by 2026; the remainder are being onboarded through 2026. The phase comparison — and the migration playbook — is in ZATCA Phase 1 vs Phase 2.

Key takeaways

Key takeaways includes: Phase 1 is a structured-invoice mandate without transport — structure, sequence, immutability, B2C QR. Live since 4 December 2021 and still in force for any wave not yet integrated.

• Phase 1 is a structured-invoice mandate without transport — structure, sequence, immutability, B2C QR.
• Live since 4 December 2021 and still in force for any wave not yet integrated.
• Penalties are shared with Phase 2; missing QR on B2C is the most-fined breach.
• Phase 1 done correctly turns Phase 2 onboarding into a configuration step, not a project.

Authority sources

• ZATCA — Phase 1 Simplified Guide (PDF)
• ZATCA — E-invoicing FAQ (PDF)
• ZATCA — What is e-invoicing?
• ZATCA — Roll-out phases
• ZATCA — Simplified Technical Guide

Ready to implement Phase 1 properly? Read the Phase 1 setup playbook, or compare with the next stage in ZATCA Phase 1 vs Phase 2. The product implementation is at /e-invoicing/zatca-phase-1.