ZATCA Phase 1 vs Phase 2: What Changes When You Integrate (2026)

The Saudi Fatoorah programme has two phases. Phase 1 (Generation, since December 2021) requires structured, tamper-resistant invoices and a five-tag TLV QR on B2C documents. Phase 2 (Integration, since January 2023, wave-based) adds a state-issued CSID, XAdES B-B signing, a SHA-256 hash chain, real-time clearance for B2B Standard Tax Invoices, 24-hour reporting for B2C Simplified Tax Invoices, and four extra QR tags for the cryptographic stamp.

Macro context — same regulator, two layers

ZATCA designed the two phases to be additive, not substitutive.

ZATCA designed the two phases to be additive, not substitutive. Phase 1 controls (structure, sequence, immutability, B2C QR, six-year archive) remain in force throughout — Phase 2 adds the cryptographic and transport layer on top. A taxpayer that built Phase 1 sloppily (editable spreadsheets, gappy numbering, no UBL payload) faces a real project for Phase 2; one that built Phase 1 correctly faces a configuration step.

Side-by-side comparison

Side-by-side comparison — Live since: 4 December 2021 — 1 January 2023 (Wave 1).

How the QR changes between phases

Phase 1 QR has five tags: seller name, VAT number, timestamp, total with VAT, VAT amount. Phase 2 adds four more: invoice hash, cryptographic stamp, public key, and (for Standard Tax Invoices) the signature of the public key.

Phase 1 QR has five tags: seller name, VAT number, timestamp, total with VAT, VAT amount. Phase 2 adds four more: invoice hash, cryptographic stamp, public key, and (for Standard Tax Invoices) the signature of the public key. The same Base64-TLV encoding, but length-byte calculation on UTF-8 still trips up implementations on Arabic seller names — see ZATCA Phase 2 common errors for the catalogue.

How the issuance flow changes

Phase 1 issuance flow

1. Sales event in ERP/POS.
2. EGS allocates the sequential invoice number atomically.
3. EGS renders structured payload (UBL 2.1 recommended) + PDF/A-3 + (B2C) TLV QR.
4. EGS persists invoice in immutable storage.
5. EGS delivers to buyer directly.

Phase 2 issuance flow

1. Sales event in ERP/POS.
2. EGS allocates ICV atomically per Solution Unit.
3. EGS renders UBL 2.1 KSA-extension XML; computes invoice hash; chains to previous (PIH).
4. EGS applies XAdES B-B signature with Production CSID after canonicalisation.
5. EGS embeds 9-tag TLV QR (Phase 1 tags + crypto stamp).
6. Standard (B2B): POST to Clearance API → receive cleared invoice → deliver to buyer.
7. Simplified (B2C): deliver to buyer immediately → POST to Reporting API within 24 hours.
8. EGS persists invoice + cleared response in immutable storage.

Migration playbook (Phase 1 → Phase 2)

Migration playbook (Phase 1 → Phase 2) includes: Confirm wave on Fatoora. The official notification names you and starts the six-month clock.

1. Confirm wave on Fatoora. The official notification names you and starts the six-month clock.
2. Onboard the Solution Unit. Generate CSR → request OTP → exchange for Compliance CSID → pass compliance checks → promote to Production CSID. Full flow in How to comply with ZATCA Phase 2.
3. Upgrade the payload. If you persisted UBL 2.1 in Phase 1, add the KSA extensions and the ProfileID; if not, schema-migrate the issuance pipeline now.
4. Initialise the hash chain. If you stored PIH in Phase 1, the chain continues. If not, the chain starts fresh from the first cleared invoice under the new CSID.
5. Switch transport. Wire the Clearance API for B2B and the Reporting API for B2C; gate B2B buyer delivery on cleared response.
6. Extend the QR. Add the four crypto-stamp tags to Simplified, and add the QR to Standard.
7. Update the archive. Store the cleared response (or reporting acknowledgement) alongside the XML and PDF/A-3.

Pre-Phase-2 checklist (run during your six-month window)

Pre-Phase-2 checklist (run during your six-month window) includes: ☐ UBL 2. 1 KSA-extension XML produced for every invoice.

• ☐ UBL 2.1 KSA-extension XML produced for every invoice.
• ☐ Production CSID installed per Solution Unit.
• ☐ Compliance certificate purged from production keystore.
• ☐ All four invoice/note types tested end-to-end against the sandbox.
• ☐ Hash chain (PIH) live; ICV gap-free.
• ☐ B2B buyer delivery gated on cleared response.
• ☐ B2C reporting job runs at least every 60 minutes.
• ☐ 9-tag QR generated and verified with ZATCA's decoder.
• ☐ Six-year archive policy extended to include cleared responses.

Key takeaways

Key takeaways includes: Phase 2 is additive: every Phase 1 control remains, and the cryptography + transport layer is bolted on top. The QR grows from 5 to 9 tags; B2B invoices gain a QR for the first time.

• Phase 2 is additive: every Phase 1 control remains, and the cryptography + transport layer is bolted on top.
• The QR grows from 5 to 9 tags; B2B invoices gain a QR for the first time.
• B2B is now cleared before delivery; B2C is reported within 24 hours.
• The migration is a project if Phase 1 was sloppy and a configuration step if Phase 1 was done right.

Authority sources

• ZATCA — Roll-out phases
• ZATCA — Detailed Guidelines for E-Invoicing v2 (PDF)
• ZATCA — Detailed Technical Guidelines (PDF)
• ZATCA — E-Invoice specifications
• ZATCA — How to prepare for Phase 2
• ZATCA — E-invoicing FAQ (PDF)

Related reading

Implementation guides: How to comply with Phase 1 and How to comply with Phase 2. Rule-set explainers: Phase 1 explained and Phase 2 explained.

Implementation guides: How to comply with Phase 1 and How to comply with Phase 2. Rule-set explainers: Phase 1 explained and Phase 2 explained. Debugging: Common errors. Product pages: /e-invoicing/zatca-phase-1 and /e-invoicing/zatca-phase-2.