If you run a business in Saudi Arabia, you've likely heard of ZATCA e-invoicing — sometimes called Fatoora. The most common question we get is specifically about ZATCA Phase 2 and what has to go into the e-invoice QR code. It's not optional, and the requirements are stricter than most business owners expect. Here's what it actually involves, in plain language.

Why this exists

The Zakat, Tax and Customs Authority (ZATCA) introduced e-invoicing to replace handwritten and unstructured PDF invoices with a standardized, traceable electronic format. The goals are straightforward: reduce the shadow economy, close the VAT compliance gap, and give the authority real-time visibility into commercial transactions.

Phase 1: Generation

Phase 1 requires businesses to generate invoices electronically, in a structured format, with specific mandatory fields — including a QR code on simplified (B2C) tax invoices. Invoices scribbled by hand or produced as unstructured PDFs no longer qualify. Your invoicing system needs to produce compliant electronic invoices from day one of a sale.

Phase 2: Integration

Phase 2 is where things get more technical. Businesses are onboarded in waves based on revenue thresholds, and once your wave is notified, your system must integrate directly with ZATCA's platform. This means:

  • Each invoice gets a cryptographic stamp and a unique identifier (UUID)
  • Invoices reference the hash of the previous invoice, creating a tamper-evident chain
  • Standard tax invoices (B2B) go through a clearance process — cleared by ZATCA before being shared with the buyer
  • Simplified tax invoices (B2C) are reported to ZATCA within 24 hours of issuance

What goes into the ZATCA Phase 2 QR code

This is usually where the real confusion starts. A Phase 1 QR code only needs to encode a handful of basic fields. Once you're onboarded into Phase 2, the QR code is more detailed and is generated as a Base64-encoded TLV (Tag-Length-Value) string that must contain:

  • Seller's name
  • VAT registration number
  • Invoice timestamp (date and time of issuance)
  • Invoice total (including VAT)
  • VAT total amount
  • Hash of the invoice XML
  • The invoice's cryptographic stamp (digital signature)
  • The public key used to generate the stamp
  • The stamp of the public key itself (for certain taxpayer groups)

In practice, this means your invoicing system can't just "print a QR code" — it needs to generate the cryptographic stamp, build the correctly ordered TLV structure, and encode it correctly, every single time, for every invoice. Getting the field order or encoding wrong is one of the most common reasons a Phase 2 integration fails ZATCA's validation.

What "compliant" actually means for your system

Compliance isn't just about printing a QR code. It means your ERP or invoicing software needs to generate invoices in the correct XML structure (based on UBL 2.1), maintain the cryptographic chain correctly, handle the API integration with ZATCA's platform, and keep working correctly as ZATCA updates its technical requirements over time.

The most common mistake we see isn't a missing QR code — it's a system that was "compliant" at go-live but wasn't built to keep up with ZATCA's ongoing updates.

How Odoo handles this

Odoo's Saudi Arabia localization includes e-invoicing support that we configure and integrate for each client's specific setup — covering both the Generation and Integration phases, QR code and cryptographic stamp generation, and the reporting/clearance flow with ZATCA's Fatoora platform. Because it's part of your existing Accounting module, invoicing stays inside the same system as the rest of your operations rather than becoming a separate compliance tool bolted on the side.

Getting started

If you're not sure which phase applies to you, or whether your current system actually meets the technical requirements, that's the first thing to check — well before any ZATCA deadline is close.