E-Invoicing Requirements for Small and Medium Businesses

On 24 July 2026 the Zakat, Tax and Customs Authority announced Wave 25 of integration with the Fatoora platform, and brought the revenue threshold down to SAR 187,500, drawing into scope a wide band of businesses whose obligation had stopped at Phase One. After reading this guide you will know whether your business is in scope, what the difference between the two phases is, what is required technically in language you can follow, and how to arrange integration before 1 February 2027 step by step.

What changed with Wave 25

The new threshold is what changed the equation: your revenue exceeding SAR 187,500 in any of the years 2022, 2023, 2024 or 2025 is on its own enough to bring you within the scope of Phase Two, and the final date for connecting your systems to the Fatoora platform is 1 February 2027. That is the substance of the wave the Authority announced on 24 July 2026, and it applies to every business subject to Value Added Tax to which that revenue applies.

The difference from earlier waves is large. Wave 24 sat at a threshold of SAR 375,000 and its deadline ended on 30 June 2026, whereas Wave 25 brought the threshold down to the level of voluntary registration in Value Added Tax, which means in practice that small businesses entirely outside this conversation are now inside it. The Authority undertakes to notify taxpayers at least six months before the integration date, but the notification is an alert to an existing deadline rather than an additional window starting from the date it arrives.

Phase One and Phase Two in plain language

Phase One began on 4 December 2021 and is called the generation and storage phase, and its substance is simple: stop issuing invoices by hand or through a word processor or an editable spreadsheet, and issue them from a compliant electronic system that stores the invoice electronically and prevents tampering with it, with the QR code on simplified invoices.

Phase Two is the integration phase, and it began in waves from 1 January 2023. Here it is not enough to have a good system, because your system must speak to the Fatoora platform directly: it sends the invoice in a specified format, it receives the response of the Authority, and the invoice carries a cryptographic stamp and a unique identifier. In short, Phase One changed the form of the invoice, and Phase Two connected it to the Authority at the moment of issue, and anyone who did not complete the requirements of the first properly will find the move to the second harder than it needs to be. The details of the scope of work are covered within our services.

Who falls within scope and how you check your position

The scope covers every person subject to Value Added Tax and resident in the Kingdom, and anyone issuing tax invoices on their behalf. Businesses not registered for Value Added Tax are outside the obligation until they register, whether mandatorily on exceeding SAR 375,000 of annual taxable supplies or voluntarily from SAR 187,500.

To check your position, review the revenue of each year from 2022 to 2025 separately, since exceeding the threshold in a single year is enough to bring you into scope. This is where the value of orderly accounting records shows, because many small businesses do not hold a reliable figure for the revenue of 2022, so if your books are incomplete, begin by putting bookkeeping in order before any technical decision. Follow up as well on the email registered with the Authority and the account of the business on the Fatoora platform, since the notification arrives through them.

The technical requirements in the language of a business owner

The technical terms look like an obstacle, but they are in reality five elements the accounting system takes care of rather than the business owner. An XML file in UBL 2.1 format means the invoice is created as a structured data file the systems of the Authority read automatically, not as an image or an ordinary PDF file. The unique UUID identifier is a number generated for each invoice that never repeats, so one invoice is never confused with another. The cryptographic stamp is a digital signature proving the invoice was issued from your approved system and was not altered after issue.

The QR code is a square printed on the invoice carrying its basic data so the buyer or the Authority can read it with a phone. The hash is a digital fingerprint linking each invoice to the one before it in a connected chain, so any deletion or tampering breaks the chain and shows up immediately. What is required of you is not building these elements, but making sure the system you buy produces them correctly and retains them, and that the invoice is issued in Arabic, with another language permitted alongside it.

The standard and simplified invoice, between clearance and reporting

The Authority distinguishes between two types of invoice, and each type has a different path. The standard tax invoice is issued between businesses or to government entities, and passes through the clearance path: your system sends it to the Fatoora platform first, the Authority clears it and adds its stamp, and it is not handed to the buyer before that.

The simplified invoice is issued to the final consumer in shops and restaurants, and is handed to them at the moment of sale carrying the QR code, and the system then sends it to the Authority through the reporting path within the window specified in the requirements of the Authority. The practical effect is clear: a retail operation needs a system that works when the connection drops and then resumes sending, whereas selling to businesses needs a stable connection at the moment of issue. In both cases the tax amount on the invoice must match what appears in the VAT return.

What to ask the software provider before contracting

Before signing with any provider, put specific questions and ask for written answers rather than verbal promises. Is the solution listed among the compliant solutions published by the Authority? Does it produce an XML file in UBL 2.1 format and a PDF version with the XML file embedded in it? Does it issue the invoice in Arabic? Does it handle issuing and renewing the cryptographic identity certificate on your behalf? Does it support both the clearance path and the reporting path?

Then ask about operation: how does the system behave when the internet drops and how does it resume sending? Where are the invoices stored, and can they be exported in full if you change provider? Does it prevent altering or deleting an issued invoice and resetting the counter numbering, which are expressly prohibited functions? Does it support credit and debit notes linked to the original invoice? And finally, what is the cost of updates when the specifications of the Authority change?

A practical readiness plan before 1 February 2027

Less than six months remain before the deadline, and that is time enough for anyone starting now. Begin by taking stock of the current position: how your invoices are issued today, how many points of sale and branches there are, and whether customer data is complete. Then verify whether you fall within scope through the revenue of 2022 to 2025, and choose the solution and settle the contract early, because pressure on providers rises as the deadline approaches.

The next step is cleaning the data: the legal name of the buyer, their tax number on standard invoices, the description of the good or service, the quantity, the unit price, the tax amount and the total, since any missing field will be rejected by the system later. After that, carry out the integration in the test environment, run both systems in parallel for two weeks, and train the cashier and the accountant on the exceptional cases: returns, discounts and cancelled invoices.

Common mistakes and their effect on your compliance

What most often puts small businesses in breach is not the complexity of the technology but simple mistaken assumptions. The best known of them is treating a PDF file sent through a messaging application as an electronic invoice, which it is not unless it was issued from a compliant system and carries the stamp and the unique identifier. Others include a standard invoice without the tax number of the buyer, keeping an image of the invoice without the original XML file, handling returns with a new invoice instead of a credit note linked to the original, and leaving a branch or a point of sale outside the integration.

The effect does not stop at invoicing: the invoice data sent to the Authority becomes a reference compared against what you declare in your returns, and any gap between the two is among the most common triggers for a query from the Authority or a request for additional data, and the steps are on the tax and zakat examination page. And if 1 February 2027 passes without your integration being complete, the obligation does not lapse by its passing, and the fines escalate according to the length of the delay.

Where to start if you are outside scope today

If your revenue falls below the threshold, that does not mean the subject does not concern you. The direction of the waves is clear: the threshold fell from SAR 375,000 in Wave 24 to SAR 187,500 in Wave 25, and a growing business may exceed the threshold in a single year and enter scope in a later wave.

Preparing early costs you nothing: choosing an accounting system that supports Phase Two from the outset is cheaper than changing it later under the pressure of the deadline, and cleaning up customer and item data benefits you in every case. And if you are considering voluntary registration for Value Added Tax in order to recover input tax, work the cost of e-invoicing compliance and periodic returns into the calculation before taking the decision.