Saudi compliance
ZATCA Phase 2 e-invoicing — how AION does it
Every sales invoice in the Saudi BG generates the XML payload, embeds the QR code, signs the document, and is ready for clearance-provider handoff. Live in the Oasis Fresh demo right now.
What ZATCA Phase 2 actually requires
The mandate, in plain terms — what every Saudi F&B factory must do.
The Zakat, Tax and Customs Authority (ZATCA) rolled out e-invoicing in two phases. Phase 1 (December 2021) required all VAT-registered businesses to issue invoices electronically — no more paper-only. Phase 2 (rolling waves from January 2023 by taxpayer size) adds clearance: every B2B invoice must be transmitted to ZATCA's portal in real time, signed, and stamped before it can be issued to the customer.
Every compliant Phase 2 e-invoice carries:
- UBL 2.1 XML structure — line items, tax breakdown, seller/buyer details in the prescribed schema
- QR code (TLV-encoded) — seller name, VAT number, invoice timestamp, total, VAT total, ZATCA UUID
- Cryptographic stamp — XAdES signature using a cryptographic certificate issued via ZATCA
- Invoice hash chain — each invoice references the previous invoice's hash, creating a tamper-evident chain
- Clearance UUID — returned by ZATCA's portal after successful submission, embedded in the final PDF/A-3
Penalties for non-compliance are real and graduated — they start at SAR 1,000 per invoice for missing format requirements and escalate quickly for repeated violations or attempts to issue uncleared invoices.
What AION generates — line by line
The capabilities below are live in the Oasis Fresh demo. Log in as cfo.saudi and inspect any sales invoice.
UBL 2.1 XML — generated, not bolted on
When a CFO clerk posts a sales invoice in the Oasis Fresh BG, the SLA engine generates the ZATCA-format XML as part of the same transaction that posts to the GL. No batch export, no nightly job — it's there when you open the invoice detail.
QR code embedded in the PDF
The TLV-encoded QR includes seller name, Oasis Fresh VAT number, invoice timestamp, total, and VAT total. The QR renders in the printable PDF — verifiable by ZATCA's mobile app at the buyer's end.
XAdES signing pipeline
AION ships the signing infrastructure — certificate management, signature application, hash-chain maintenance. You upload your ZATCA-issued certificate once; every invoice signs with it automatically.
Clearance handoff — configurable
AION generates the cleared document and is provider-agnostic for the submission step. You integrate with any ZATCA-approved clearance partner (or use direct submission if your business is registered). We don't lock you into a single vendor.
Phase 1 + Phase 2 in the same engine
B2C invoices (Phase 1 — simplified e-invoice) and B2B invoices (Phase 2 — standard with clearance) use the same engine. Configuration per invoice type, not separate systems.
Credit notes and debit notes — same treatment
Returns, credits, debits all generate the matching ZATCA documents with reference to the original invoice's UUID. Audit-traceable trail end to end.
What going live actually looks like
Honest expectations — not vendor-speak.
A Saudi F&B factory implementing AION with ZATCA Phase 2 typically goes through:
- VAT number + ZATCA portal registration confirmed. You need an active VAT registration and ZATCA portal access before the certificates can be issued. This is on you, not the ERP.
- Cryptographic certificate generation. ZATCA issues a CSID (Cryptographic Stamp Identifier) and a certificate via their portal. You upload these to AION once.
- Clearance provider selection. Decide whether to integrate directly or via a ZATCA-approved provider. AION supports both — we have integration templates for the common providers.
- Onboarding sandbox testing. Issue 50–100 test invoices against ZATCA's sandbox, verify clearance returns successfully, validate the QR codes with the ZATCA app.
- Production cutover. Switch the endpoint from sandbox to production. The Oasis Fresh demo BG is configured exactly this way — you can inspect every setting.
Realistic timeline: 5–10 business days end-to-end if your VAT registration is current and you have a clearance provider chosen. The technology side is configuration, not custom development.
ZATCA + AION — common questions
Is AION itself certified by ZATCA?
ZATCA certifies clearance providers, not ERPs. AION generates documents in the ZATCA-required format, signs them with your ZATCA-issued certificate, and hands them to your chosen clearance provider. The compliance certification path is provider-side; our role is correct document generation.
What if our clearance fails — invoice rejected by ZATCA?
Failed clearance returns an error code. AION surfaces this on the invoice screen with the specific ZATCA error. Common causes (wrong VAT number on buyer, malformed line item, expired certificate) are diagnosable. Once corrected, you resubmit — AION handles the retry flow.
Do we need separate software for ZATCA reporting?
No. AION's VAT return (the periodic VAT remittance form) is generated from the same data that powers e-invoicing. Both VAT input (purchases) and VAT output (sales) feed the return automatically.
How does AION handle the invoice hash chain when migrating from another ERP?
The hash chain restarts at the first invoice issued through AION. Your historical invoices from the prior ERP retain their original signatures; AION's chain begins from go-live. ZATCA accepts this transition.
Can AION generate invoices in Arabic for ZATCA?
Yes. The Arabic and English invoice content is bilingual in the same document — ZATCA requires both. Invoice lines, descriptions, buyer/seller details are stored bilingually and render based on the recipient configuration.
What about simplified e-invoices for B2C transactions in a Saudi F&B factory?
Same engine, different document type. The factory's direct-to-consumer sales (e.g. employee canteen or retail samples) generate Phase 1 simplified e-invoices with QR codes. The B2B Panda/Othaim/BinDawood invoices generate Phase 2 cleared documents.
See ZATCA Phase 2 in the live demo
Log into the Oasis Fresh BG as cfo.saudi, open any sales invoice, and inspect the XML payload, QR code, and clearance trail.