ZATCA Phase 2 e-invoicing for Saudi workshops

What Phase 2 actually changes

Saudi e-invoicing arrived in two stages, and the difference between them is not cosmetic. Phase 1, called Generation, made paper and free-form PDF invoices unacceptable: from 4 December 2021 every VAT-registered business had to issue invoices from a compliant electronic system, store them electronically, and print a QR code on simplified invoices. The system was still working on its own — nothing was sent anywhere.

Phase 2, called Integration, removes that isolation. Your billing system now talks to ZATCA’s Fatoora platform over an API for every single invoice. Depending on the invoice type, that conversation happens either before the customer receives the document or shortly after. An invoice that never completes that conversation is not a valid tax invoice, no matter how correct it looks on screen.

For a workshop this is the practical consequence: invoicing stops being a printing step at the end of the job and becomes a system function with a dependency on an external service. That changes what you need from your software — not just correct totals, but sequencing, retry handling, and an audit trail that survives scrutiny.

Source: ZATCA e-invoicing portal (zatca.gov.sa)

Clearance and reporting: two different invoices, two different flows

Phase 2 treats standard tax invoices and simplified tax invoices differently, and confusing the two is the most common source of trouble. A workshop typically issues both: corporate fleet and insurance work produces standard invoices, while walk-in retail customers get simplified ones.

• A standard invoice is only legally issued once ZATCA returns it cleared. If clearance is rejected, the document must be corrected and resubmitted — it cannot simply be handed over.
• A simplified invoice is given to the customer immediately and reported afterwards, which is why the counter shop can keep working during a network outage while B2B invoicing cannot.
• Credit and debit notes follow the same route as the invoice they correct, and must reference the original invoice.

What the system has to produce

Phase 2 specifies the document itself, not just its contents. These are the elements a compliant system generates for every invoice, and the reason a spreadsheet or a generic invoice template cannot be made compliant by adding fields to it.

• XML in UBL 2.1 following the Saudi e-invoice XML implementation standard — the XML is the invoice; any human-readable PDF is a rendering of it.
• A UUID uniquely identifying the document, distinct from your own invoice number.
• An Invoice Counter Value (ICV) that increments by exactly one for every invoice, with no gaps and no resets — including across a system restart.
• A Previous Invoice Hash (PIH) that embeds a hash of the preceding invoice, so the whole sequence forms a chain that cannot be re-ordered or edited after the fact.
• A cryptographic stamp applied with a certificate issued by ZATCA during onboarding.
• A QR code carrying the seller name, VAT registration number, timestamp, invoice total including VAT, and VAT amount — plus, in Phase 2, the cryptographic stamp itself.
• Electronic archiving of the XML, retrievable for the statutory retention period.

Source: ZATCA e-invoicing portal (zatca.gov.sa)

Getting connected: the Fatoora onboarding sequence

A system does not simply start sending invoices to ZATCA. Each taxpayer device or solution unit is enrolled through a defined sequence on the Fatoora portal, and the certificates that come out of it are what make the cryptographic stamp valid.

• Generate a Certificate Signing Request (CSR) carrying the taxpayer’s VAT registration details and the identity of the solution unit.
• Obtain an OTP from the Fatoora portal and exchange the CSR for a Compliance CSID (CCSID) — a temporary certificate used only for testing.
• Pass ZATCA’s compliance checks by submitting sample standard invoices, simplified invoices, and credit and debit notes that the platform validates.
• Exchange the CCSID for a Production CSID (PCSID), the certificate used to stamp live invoices.
• Renew the production certificate before it expires — an expired CSID stops clearance and reporting, and therefore stops valid B2B invoicing.

Source: ZATCA e-invoicing portal (zatca.gov.sa)

What ZATCA prohibits

The regulation is as specific about what a compliant system must prevent as about what it must produce. These prohibitions are aimed squarely at the ways invoice records were historically adjusted after the fact, and they are worth reading as a checklist when evaluating any vendor.

• No uncontrolled access to the invoice counter — a user must not be able to set, reset or roll back the sequence.
• No editing or deleting of issued invoices; corrections happen through credit and debit notes that reference the original.
• No tampering with the invoice log or the audit trail.
• No changing the system clock to alter invoice timestamps.
• No export of the cryptographic stamping key from the device or environment holding it.
• No anonymous or unattributable access — actions must be traceable to a user.

How MotorMind handles it

MotorMind supports both phases of the mandate. Invoices are generated in the required electronic form with the QR code that Phase 1 requires, and for Phase 2 the system produces the UBL 2.1 XML, maintains the invoice counter and hash chain, applies the cryptographic stamp, and exchanges documents with the Fatoora platform — clearing standard tax invoices before they reach the customer and reporting simplified tax invoices within the required window.

Because MotorMind is a workshop system rather than a bolt-on invoicing tool, the invoice inherits its content from the work that produced it. The job card records what was done, the approved quotation fixes what the customer agreed to, parts issued from inventory carry their own VAT treatment, and the invoice assembles from those records instead of being retyped. That matters for compliance: the most common cause of a rejected or wrong invoice is not a technical fault in the XML but a mismatch between what was billed and what the underlying records say.

Invoice status is visible in the system, so a document that has not been cleared or reported is identifiable rather than assumed. Corrections go through credit and debit notes referencing the original invoice, which is both what the regulation requires and what keeps the workshop’s own revenue reporting honest.

What Phase 2 means on a workshop floor

The regulation is written for all VAT-registered businesses, but its friction points land differently in a service workshop than in a retail shop, because a workshop invoice is the end of a long process rather than a single transaction.

• Scope changes mid-repair are normal. If additional work is approved after the original quotation, the invoice has to reflect the approved scope — which is an argument for capturing approvals in the system rather than over the phone.
• Parts and labour carry VAT the same way, but parts come out of inventory. If stock movements and invoice lines are maintained separately, they drift, and the VAT return is built on the drift.
• Insurance and fleet work is B2B, so it needs clearance and a buyer VAT number captured up front — not chased at invoicing time.
• Deposits and progress payments against an open job card need to be reconciled to the final invoice rather than left as loose receipts.
• A workshop that issues both simplified and standard invoices needs both flows working, not just the one it uses most often.

Moving a workshop onto Phase 2

The technical integration is the part vendors talk about, but it is rarely what delays a workshop. What delays a workshop is data: VAT registration numbers that were never collected for fleet customers, a parts catalogue with inconsistent tax treatment, and an invoice numbering history that has gaps in it.

The practical order is to get the underlying records clean first — customer tax details, the parts catalogue, the opening state of inventory and receivables — then onboard the solution unit through Fatoora and run ZATCA’s compliance checks against real document types. A migration that skips the first step passes the compliance checks and then produces wrong invoices in production.

For specific obligations, filing deadlines and the wave your business falls into, ZATCA’s own portal is the authority, and a Saudi tax adviser should confirm your position. This page describes how the mechanism works and how MotorMind implements it; it is not tax advice.

Source: ZATCA e-invoicing portal (zatca.gov.sa)

Frequently asked questions