ZATCA Phase 2 for restaurants: what actually has to change
Saudi Arabia's e-invoicing rules in plain terms: what Phase 2 requires of a restaurant, what your POS has to do, and how to tell whether you are actually compliant.
Phase 2 means your restaurant's system must talk to ZATCA directly. It is no longer enough to print an invoice with a QR code on it — the invoice has to be generated in a specific XML format, cryptographically stamped, and either cleared with or reported to the Fatoora platform. For a restaurant, almost all of that should be invisible: the till rings up a sale and the compliance happens behind it.
Phase 1 versus Phase 2, in one line each
Phase 1 (from December 2021): generate invoices electronically, include the required fields, print a QR code. Your system worked alone.
Phase 2 (rolling out in waves since January 2023): your system must integrate with ZATCA. Invoices carry a cryptographic stamp and a UUID, and they are transmitted.
What a restaurant actually issues
Almost everything a restaurant sells is a simplified tax invoice — a B2C sale to a walk-in customer. These are reported to ZATCA within 24 hours rather than cleared in advance, which matters: your till does not wait for a round trip before printing.
The exception is a corporate booking or a catering invoice to a registered business. Those are standard tax invoices, and they must be cleared by ZATCA before you issue them.
A restaurant POS needs to handle both, and to know which is which without the cashier having to decide.
What has to be on the invoice
- Your name and VAT registration number
- The invoice date and time
- Each line, with the VAT charged
- The total excluding VAT, the VAT amount, and the total including VAT
- A QR code containing the seller name, VAT number, timestamp, total, and VAT amount
- For Phase 2: the cryptographic stamp and the invoice UUID
- Arabic — the invoice must be issued in Arabic, though it may also carry another language
That last point catches people out. An English-only receipt is not compliant, however correct everything else on it is.
How to tell whether you are actually compliant
Three checks, in order:
- Scan your own QR code with ZATCA's app. If it does not resolve, nothing else matters.
- Check the Arabic. Not just the totals — the line descriptions too.
- Look at what your system does when ZATCA is unreachable. This is the one nobody tests. A till that stops selling because an API is down is not a compliance solution, it is an outage. Invoices should queue and report when the connection returns.
The practical advice
Do not treat this as an IT project to be done once. Treat it as something your POS does, the way it prints. If compliance depends on a person remembering to export a file each week, it will fail during a busy Ramadan service — which is exactly when you can least afford it.
Ask any prospective supplier a single question: show me a receipt from your system, printed on a real thermal printer, and let me scan the QR code. Everything else is a brochure.
Try it on your own restaurant
Everything described here is in the software. A 7-day trial opens immediately, with no card.