What Phase 1 Actually Required
Phase 1 (Generation Phase), effective 4 December 2021, required all VAT-registered resident taxpayers to generate invoices electronically through a compliant E-Invoice Generation Solution (EGS). The key word is “generation” — Phase 1 had nothing to do with ZATCA’s systems. The obligation was entirely on the taxpayer’s side: use a compliant system to produce, store, and present on demand a valid electronic invoice.
Critically, Phase 1 did not mandate a specific invoice format. XML was not required. PDF was acceptable. Any electronic format was permitted — as long as it was produced by a compliant EGS. The format restriction came with Phase 2. What Phase 1 did mandate, from day one, was the full set of tamper-proofing and prohibited functionality rules.
| Requirement | Phase 1 Position |
|---|---|
| Electronic generation | Mandatory from 4 Dec 2021 |
| Invoice format (XML, PDF etc.) | No format mandated — any electronic format |
| QR code | Required on Simplified Tax Invoices (4-field basic format) |
| Cryptographic stamp / UUID | Not required |
| FATOORA platform integration | Not required |
| Tamper-proofing and prohibited functionalities | Mandatory from 4 Dec 2021 |
| Record keeping and archival | Mandatory — ongoing (6-year retention) |
Mandatory Fields — Tax Invoice vs. Simplified Tax Invoice
Both invoice types carry mandatory fields defined in Article 53 of the VAT Implementing Regulation and Annex 2 of the E-Invoicing Resolution. The Tax Invoice (B2B) carries more fields — reflecting the buyer’s need for the document to support an input tax deduction claim.
| Field | Tax Invoice | Simplified Tax Invoice |
|---|---|---|
| Invoice type description | Mandatory | Mandatory |
| Invoice reference number (sequential) | Mandatory | Mandatory |
| Invoice issue date | Mandatory | Mandatory |
| Seller name and VAT registration number | Mandatory | Mandatory |
| Seller address | Mandatory | Mandatory |
| Buyer name | Mandatory | Not required |
| Buyer VAT registration number | Mandatory | Not required |
| Buyer address | Mandatory | Not required |
| Line items with VAT per line and totals | Mandatory | Mandatory |
| QR code | Not required in Phase 1 | Mandatory (4-field) |
| Exemption reason code (where applicable) | Mandatory for zero-rated/exempt supplies | Mandatory for zero-rated/exempt supplies |
An invoice for a zero-rated or exempt supply that simply shows “VAT: SAR 0” without an exemption reason code from ZATCA’s approved list is non-compliant — even if the zero-rating treatment is correct. This is one of the most consistently missed Phase 1 requirements.
What “Electronically Generated” Means
ZATCA’s regulation is explicit: a paper invoice converted to an electronic format through copying, scanning, or any other method is not a compliant electronic invoice. A PDF exported from Microsoft Word or Excel is not compliant. A handwritten invoice photographed and emailed is not compliant.
A compliant Phase 1 EGS is a purpose-built electronic system — software that generates the invoice natively in a structured digital format, with the mandatory tamper-proofing features active. The distinction is between a document-creation tool and an invoice-generating system. ZATCA distinguishes between these categories, and the distinction is tested on audit.
Al-Rashid Consulting Co. issued invoices in 2022 using a Word document template saved as PDF and emailed to clients. All mandatory fields were present, VAT was correct at 15%. On a 2024 ZATCA audit, the auditor identifies every invoice as non-compliant: the generating “system” was a word processor with no tamper-proofing, no session logging, no sequential counter, and no prohibition on deletion. Every invoice from that period is technically an invalid VAT document — regardless of content accuracy.
Prohibited Functionalities — From Phase 1 Go-Live
The E-Invoicing Resolution (Section 5.6) specifies functionalities that no compliant EGS may enable — effective from 4 December 2021. A system that permits any of the following is non-compliant, regardless of how well-formatted its invoices are.
| Prohibited Function | What This Means in Practice |
|---|---|
| Anonymous access | System must require unique login credentials — no shared logins, no guest access |
| Default password operation | Factory passwords must be replaced on first use — system must enforce password reset |
| Absence of user session management | System must log all user activities from login through invoice generation — a full audit trail |
| Invoice alteration or deletion | Once generated, invoices cannot be modified or deleted. Cancellations must be via credit note |
| Log modification or deletion | System activity logs must be immutable — no staff member can alter or erase them |
| Inaccurate timestamps | Users cannot change the system date to backdate or forward-date invoices |
| Non-sequential log generation | All log entries must be time-stamped and chained — making sequence manipulation detectable |
| Invoice counter reset | The sequential counter must increment continuously and cannot be reset, even at year-end |
The existence of a prohibited functionality in your system makes every invoice it generates non-compliant — regardless of whether that functionality was ever used. A system that allows invoice deletion but where no invoice has ever been deleted is still non-compliant. ZATCA’s test is capability, not usage history.
Record-Keeping — The Obligation That Does Not Expire
Phase 1 invoices must be archived in accordance with VAT Law requirements. The standard retention period is six years from the end of the tax period to which they relate. Invoices from December 2021 must be retained until at least 2027. They must be accessible to ZATCA at any point in time on request.
Storage can be on-premises in Saudi Arabia or in a cloud environment — both are permissible. What matters is that the archive is complete, searchable, and can be produced to ZATCA auditors in a workable format. If your old system has since been decommissioned, the archived data must still be producible. “We upgraded our ERP” is not an answer to a record production request.
Common Phase 1 Compliance Mistakes
- Using a PDF-from-Word or Excel workaround. The most widespread Phase 1 mistake. The generating tool was not an EGS — it had no tamper-proofing, no session logging, no sequential counter. Every invoice produced this way is non-compliant.
- Missing the QR code on Simplified Tax Invoices. Phase 1 required a QR code on B2C simplified invoices from 4 December 2021. Businesses that issued simplified invoices without a QR code — or with one containing incorrect data — have non-compliant records.
- Shared login credentials. Multiple staff members logging in under a single shared account violates the session management requirement. ZATCA cannot identify which individual generated or modified any given record. The system is non-compliant from first use.
- Scanning paper invoices as a transition measure. A paper invoice converted to electronic format through scanning is explicitly not a compliant e-invoice, regardless of what happens to it afterwards.
- Failing to preserve the archive after a system upgrade. Migrating to a new ERP without carrying across Phase 1 invoice data — or storing it in a format no longer accessible — creates an archive gap. The original non-compliance may have been zero, but the failure to preserve the record creates a new and separate violation.
Frequently Asked Questions
- Phase 1 required electronic generation through a compliant EGS from 4 December 2021. No specific format was mandated, no FATOORA integration required — but the tamper-proofing and prohibited functionality rules applied in full from day one.
- A PDF from Word, a scanned paper invoice, or an Excel-generated document is not a compliant Phase 1 e-invoice. The test is the system, not the format of the output file.
- Simplified Tax Invoices required a QR code from Phase 1. Tax Invoices did not. Any B2C business that issued simplified invoices without a QR code from December 2021 has a Phase 1 compliance gap.
- The record-keeping obligation runs for six years. ZATCA auditors can examine Phase 1 records today. The archive must be preserved even after a system upgrade — failure to produce records on demand is a separate violation.
- ZATCA’s penalty waiver initiative (open until 30 June 2026) is the practical route for businesses with known Phase 1 gaps to regularise their position before enforcement action.
Also in this series
This article reflects ZATCA’s E-Invoicing Regulation (December 2020) and the Controls, Requirements, Technical Specifications and Procedural Rules Resolution (May 2023). It is for informational purposes only and does not constitute legal or tax advice. Confirm the current position at zatca.gov.sa or with a qualified Saudi tax advisor. dariba.co is an independent platform with no consulting relationships.