ZATCA E-Invoicing Phase 2 Checklist (Free, Export)

0%

0 of 35 items complete

13 critical items still open - these are the highest-risk gaps.

Download checklist:

Scope and governance

Confirmed whether your taxpayer group has been notified for an integration phase wave and noted the deadlineCRITICALNamed an owner in finance and an owner in IT for the ZATCA programmeListed every system that issues invoices, credit notes and debit notes (ERP, POS, billing tools, portals)CRITICALMapped which invoices are standard (B2B and B2G) and which are simplified (B2C)Decided whether to extend the ERP, buy a certified add-on, or use a middleware or solution providerReviewed the latest ZATCA e-invoicing regulation, security features and technical specification documentsSet a test and parallel-run plan with dates before the go-live deadline

Onboarding and security

Registered each invoicing device or solution unit in the Fatoora portal with the correct VAT numberCRITICALGenerated a certificate signing request (CSR) with the fields ZATCA requires for each solution unitCRITICALObtained a one-time password from the portal for onboarding and recorded who requested itReceived a compliance CSID and passed the compliance checks with sample invoicesCRITICALRequested the production CSID and stored the certificate and private key in a secured key storeCRITICALDefined a renewal and revocation procedure for certificates before they expireRestricted access to private keys to a minimal named group, with audit logging

Clearance and reporting flow

Standard invoices are sent for clearance and are not delivered to the buyer until ZATCA returns the cleared invoiceCRITICALSimplified invoices are signed locally, carry a QR code and are reported to ZATCA within the allowed timeCRITICALThe cryptographic stamp and QR code returned or generated are stored with the invoice recordError and warning responses from the API are captured, shown to users and have an owner for resolutionA retry queue exists for outages so no invoice is lost or issued out of sequenceContingency steps are documented for ZATCA or network downtime

Operations and records

Invoices and related data are archived for the period required by law, in a retrievable formatCRITICALFinance users are trained on what to do when an invoice is rejected or needs a credit noteReconciliation compares ERP invoice register, cleared invoices and the VAT return each periodMaster data quality for customer VAT numbers and addresses has been cleaned before go-liveChange control covers ERP upgrades that might alter invoice XML mapping

Tick each item you can evidence today. Critical items are the ones that block clearance or reporting if missing. Confirm your wave date and technical specifications on the ZATCA Fatoora portal, because requirements are updated by ZATCA.

Want a second pair of eyes on your ZATCA mapping?

Send us your ERP tax codes and a sample invoice and we will review the mapping against the checklist. Optional, no obligation.

Optional. The tool and every export work without this. No spam.

How to use this checklist

Work through the groups in order. Tick only what you can show evidence for, such as a screenshot of a production CSID, a sample cleared invoice, or a documented procedure. Items marked critical are the ones that typically cause rejected invoices or blocked delivery to customers. Export the result to PDF or Excel and use the unticked rows as your task list, assigning an owner and date to each. Re-run it after each test cycle so you can see progress move toward a full pass.

What Phase 2 changes compared with Phase 1

Phase 1, the generation phase, required an e-invoice in a structured, tamper-resistant form with a QR code and no handwritten or edited invoices. Phase 2 adds integration. Your system sends standard invoices to ZATCA for clearance, and reports simplified invoices within a set time. It also uses certificates (CSIDs), XML in the UBL 2.1 format, a unique UUID, an invoice counter and a hash of the previous invoice to form a chain.

Standard invoices (B2B, B2G) are cleared before they reach the buyer
Simplified invoices (B2C) are reported after issue within the allowed window
Each invoice references the hash of the previous one
Credit and debit notes follow the same technical rules

ERP considerations for manufacturers

Most manufacturers invoice from an ERP billing module, plus occasional manual or portal invoices that are easy to forget. Inventory the lot. Next, check how your tax codes map to ZATCA VAT categories, because a zero-rated export and an exempt supply need different reason codes. Check how your ERP numbers invoices, since a gap or reuse of numbers conflicts with the counter and hash chain. Finally decide where signing happens: inside the ERP, in a middleware layer, or in a certified add-on. Test with real edge cases such as partial shipments, advance payments, discounts and credit notes.

Common mistakes

Teams often leave onboarding to the last month and then discover that certificates, devices and test cases take longer than expected. Other frequent errors include mismatched totals caused by rounding, missing buyer data on standard invoices, issuing a credit note without the original reference, and failing to plan for outages. Treat the rule set as living material: ZATCA publishes updates, so confirm each point against the current official documentation before go-live.

Frequently Asked Questions

Is this checklist an official ZATCA document?

No. It is a practical readiness checklist written from the public structure of the integration phase. Always confirm requirements, wave dates and technical specifications against the current documents published by ZATCA on its official portal.

What is the difference between clearance and reporting?

Clearance applies to standard invoices: they are submitted to ZATCA and approved before the buyer receives them. Reporting applies to simplified invoices: they are issued and signed locally, then reported to ZATCA within the permitted period afterwards.

What is a CSID?

A CSID is a cryptographic stamp identifier, effectively a certificate issued to a registered solution unit. A compliance CSID is used to pass tests, and a production CSID is then used to sign and submit live invoices.

Do we need to replace our ERP?

Not necessarily. Many ERPs can be extended with a vendor module, a certified add-on or middleware that builds the XML, signs it and calls the ZATCA APIs. The key is that the data mapping, numbering and archive rules are correct.

If you want to expose clearance status and rejected-invoice reasons from your ERP in plain language, Netray can help build a read-only view over your invoice data on infrastructure you control.

Talk to an Expert Explore More Free Tools

Related Tools

Country & Tax

More Country & Tax tools

See all

Saudi ZATCA E-Invoicing Phase 2 Integration Checklist