Phase 2 changes in invoicing

When and how will I be informed about my business’ Phase 2?

The authority will determine the various targeted groups and phases of the integration for all persons subject to e-invoicing. They will be notified of the implementation procedures for the integration with the authority’s systems at least 6 months before the due date. The integration can be done using APIs “Application Programming Interface” complying with the timelines, with the targeted groups, and with the implementation phases of integration with the Authority’s systems.

What are the technical functionalities required for e-invoicing solutions in phase 2?

1. The format of the electronic invoice or debit/credit note

• XML mandated by the ZATCA
• PDF/A3 with the XML embedded file. This format is optional and useful for sharing the invoice with the customer.

2. The structure of the electronic invoice or debit/credit note

Tax invoices, credit, and debit notes must satisfy the [technical requirements outlined by ZATCA].

3. The processing of data and security reinforcement

• A unique ID is generated for each invoice and associate notes
• A counter that is tamper-resistant for each e-invoice and its associated notes

4. Cryptographic stamps for simplified tax invoices only and their associated notes

1. Electronic invoicing systems must have a unique cryptographic stamp identifier for each invoice and its associated notes
2. Each invoice and its associated notes should have a cryptographic stamp
3. The cryptographic stamp identifier has to be issued and managed through the Authority’s portal. Taxpayers can request their cryptographic stamp identifier by logging in to their current accounts in the Authority’s portal.
4. A stamping key associated with a cryptographic stamp identifier has to be generated
5. When the cryptographic stamp identifier is renewed, a new stamping key should also be generated
6. The stamping key should be recognized as non-exportable to limit exports outside of the security module
7. In the e-invoicing solution, disk encryption will be used to protect the stamping key when using software that stores that key



5. The use of additional cryptographic capabilities

- The use of standard secure hashing algorithms

6. The use of the Universal unique identifier (UUID)

- The UUID is a 128-bit number. This number is generated by an algorithm that makes it very unlikely that anyone else would have the same identifier

7. The generation of QR codes for all types of electronic invoices and notes containing the following information

- The seller’s name

- The seller’s VAT registration number

- The electronic invoice’s or note’s timestamp (date/time)

- The electronic invoice’s or note’s amount including VAT

- The VAT amount

- The electronic invoice’s or note’s hash of XML

- The cryptographic stamp:

- For simplified tax invoices and their associated notes: E-invoice generation solution generates are responsible for generating stamps

- For tax invoices that are integrated with the ZATCA’s portal and their associated notes: The ZATCA generates their stamps

8. The public key used for the generation of cryptographic stamps

- For simplified tax invoices and their associated notes: This key corresponds to the e-invoicing generating solution’s key

- For tax invoices that are integrated with the ZATCA’s portal and their associated notes: The ZATCA’s platform’s public key can optionally be

9. Ensuring connectivity

- The ability to ensure safe and encrypted connections such as TLS

- The ability to periodically upload in bulk simplified tax e-invoices and their associated notes to external API

- The ability to periodically submit in bulk tax e-invoices and their associated notes in real-time to receive a swift response

- When the electronic invoicing solution is offline, the issued e-invoices and their associated notes are queued. The data is reported as soon as the connection is re-established

What are prohibited functions specified by the ZATCA for e-invoicing compliant systems in phase 2?

1. The export of stamping keys

- Providing the option of exporting cryptographic stamp stamping key

2. Time change

• Allowing software time changes
• Allowing the modification of timestamp values when issuing an e-invoice, credit, or debit note