ZATCA Phase 2 waves: where the rollout stands in 2026

Saudi Arabia has been running the same play for three years. The Zakat, Tax and Customs Authority sets a revenue threshold, names the taxpayers above it as a wave, gives them a date to connect their invoicing system to the Fatoora platform, and then lowers the threshold again. Each round pulls a smaller class of business into the integration phase.

Wave 25 is the round where that arithmetic stops being an enterprise problem. The threshold is now SAR 187,500 of VAT-subject revenue, which is roughly AED 183,000 a year, and a business at that level is not a large company by any definition. If you invoice in the Kingdom at all, the practical assumption should be that you are in scope and the only open question is your date.

What the integration phase actually requires

It helps to be precise about what changes, because the two phases are often discussed as though they were one long compliance exercise.

Phase One, the generation phase, began on 4 December 2021. It ended handwritten invoices and invoices produced in text editing or spreadsheet software, and required taxpayers to run a compliant electronic solution that generates and stores invoices carrying the required fields, including the QR code. For most businesses this meant buying or configuring accounting software and little else.

Phase Two, the integration phase, is a different order of work. ZATCA describes the most prominent additional requirements as integrating your e-invoicing solution with the Fatoora platform, issuing invoices in a specified format, and including additional fields in the invoice. In practice that means structured XML rather than a PDF, a cryptographic stamp, and a live connection to a government platform sitting in the middle of your billing process. Standard tax invoices go through clearance before they reach the customer. Simplified invoices are reported afterwards.

The distinction matters commercially. Phase One was a software purchase. Phase Two is an integration project with a hard cutover date, and a failed cutover does not degrade gracefully. It stops you invoicing.

Where the thresholds have gone

The direction of travel is the clearest signal available about what comes next.

ZATCA publishes each wave's criteria on its own media centre, and that page is the only source worth relying on. Confirm your position against ZATCA's published criteria and against the notification sent to you, not against a summary table on a vendor website, including this one.

Two features of the criteria catch people out. The first is the qualifying-years wording. Wave 25 covers revenue that exceeded the threshold during 2022, 2023, 2024 or 2025, so a single strong year anywhere in that window puts you in scope permanently. A business that billed well in 2022 and has been quieter since is still captured. The second is that the test is revenue subject to VAT, not total turnover and not profit. Zero-rated and exempt supplies sit outside the calculation, which occasionally moves a borderline business, but very rarely at a threshold this low.

How to work out where you stand

The check is short. Pull VAT-subject revenue for each of 2022, 2023, 2024 and 2025 from your VAT returns rather than from management accounts, because the return is the figure ZATCA is reading. If the highest of those four years exceeds SAR 187,500, plan on 1 February 2027 unless a notification tells you otherwise. If it does not, you are very likely in a future wave rather than out of the programme, because the threshold has fallen at every round and there is no published floor.

Then check the notification. ZATCA notifies targeted taxpayers directly and states that it informs waves at least six months before their integration date. If you have crossed a threshold and heard nothing, treat that as an administrative gap to chase rather than as an exemption. The obligation follows the criteria, not the letter.

What the work involves once you are in scope

Four things have to be true on your integration date, and each of them takes longer than teams expect.

• Your system produces compliant structured invoices. Odoo, NetSuite, SAP Business One and Microsoft Dynamics all have Saudi localisation available. Available is not the same as configured, and a localisation module that has never been switched on is not a state of readiness.
• Your master data is clean enough to clear. This is where most of the effort actually goes. Missing VAT registration numbers, unstructured customer addresses, inconsistent item and unit-of-measure codes, and free-text tax categories all pass silently in a PDF and fail against a schema. Fixing them is a data project, not a configuration setting.
• Cryptographic identity is in place. Onboarding your solution to Fatoora and obtaining the certificates it needs is a discrete step with its own approvals, and it is the one most commonly left until the final fortnight.
• You have tested with real invoices. Not sample data. Your own edge cases: credit notes, invoices against advance payments, multi-currency billing, exports, and whatever else your business does that a demo dataset never includes.

Working backwards from 1 February 2027, a business starting in the fourth quarter of 2026 has enough room to do this calmly. A business starting in January does not, and it will be competing for implementation capacity with everyone else in the largest wave ZATCA has announced.

If you operate in both the UAE and Saudi Arabia

Many GCC groups are now facing two mandates on overlapping timelines. The UAE has its own e-invoicing programme with its own fixed dates, its own accredited service provider model and its own technical standard, and it is not a copy of the Saudi one. The formats differ, the clearance model differs, and a solution that satisfies ZATCA does not automatically satisfy the UAE requirement.

The useful move for a group is to treat them as one programme with two outputs. The data cleanup underneath both is the same work, the ERP is usually the same ERP, and doing the customer master and item master once rather than twice is where the saving is. Sequencing them separately is how groups end up paying for the same remediation twice.

How Kaido helps

We implement e-invoicing on Odoo, NetSuite and SAP Business One for businesses operating in the UAE and Saudi Arabia. We take no vendor commissions, so the assessment you get is about which route fits your systems and your dates rather than about a product we have an interest in selling.

A scoping conversation on this is short. We look at what you invoice, what system you invoice from, which years put you in scope, and what your master data looks like today. That is usually enough to tell you whether your date is comfortable or tight, and what the first fix is.