ZATCA Phase 2 for Auto Workshops in Saudi Arabia: What Every Workshop Owner Must Know (2026)

Saudi Arabia's ZATCA Phase 2 e-invoicing mandate extends to auto workshops, garages, tire shops, and service centers across the Kingdom. If your workshop issues VAT invoices and you haven't integrated with the Fatoorah portal yet, you are either already in violation or rapidly approaching your wave enforcement deadline. Phase 2 is not an upgrade to Phase 1 — it is a fundamentally different compliance regime that requires real-time electronic submission of every invoice you issue. This guide covers exactly what Phase 2 requires for workshops: the technical specifications, the wave schedule, the invoice types you must handle, a step-by-step compliance checklist, and what happens if you ignore it. If you run an auto workshop software in Riyadh or operate workshop software for Jeddah, read every section carefully — your penalty clock may already be running.

What ZATCA Phase 2 Means for Auto Workshops

Phase 2 of Saudi Arabia's e-invoicing rollout — formally known as the Integration Phase — requires that every VAT invoice you issue be cryptographically signed and submitted to ZATCA's Fatoorah API in real time before it reaches your customer. This is a sharp departure from Phase 1, which required only that invoices carry a QR code generated offline by your system. Under Phase 2, the Fatoorah portal either clears or rejects each invoice, and your customer legally cannot act on an invoice that has not been cleared.

For auto workshops, this means your point-of-sale or workshop management system must be directly connected to the Fatoorah API at all times, must hold a valid Cryptographic Stamp Identifier (CSID) certificate issued through the portal, and must embed a cryptographic hash chain linking every invoice to the one before it. A printed invoice your technician writes by hand, or a PDF generated by basic accounting software, no longer meets the legal standard once your Phase 2 wave date passes.

Phase 1 vs Phase 2 — The Key Difference for Workshops

Which Saudi Workshops Must Comply — and By When?

Every VAT-registered auto workshop in Saudi Arabia must comply with ZATCA Phase 2 — regardless of revenue size, number of employees, or whether you operate a single bay or a full fleet service center. ZATCA's compliance rollout is organised into waves, with each wave assigned a specific enforcement start date. The waves are determined primarily by your annual taxable revenue in the most recently assessed tax period.

To find your exact wave and enforcement date, log in to zatca.gov.sa with your VAT registration number and check the Fatoorah portal notification. ZATCA sends written notification at least six months before your wave enforcement date. If you received a notification and have not acted on it, you may already be in violation. If you are unsure of your wave, your VAT registration certificate contains your revenue bracket data which maps to the table above.

Important note for workshop owners: even if your individual workshop revenue is below SAR 40M, workshops that are part of a larger group or holding company may have been assessed at the group revenue level and placed in earlier waves. Check the Fatoorah portal to be certain.

ZATCA Phase 2 Technical Requirements for Workshop Software

Not every software system that generates invoices qualifies as Phase 2 compliant. ZATCA specifies exact technical standards that your workshop POS or management system must meet before your first compliant invoice can be issued. Here is what the specification requires:

• UBL 2.1 XML format: Every invoice — whether for a simple oil change or a major engine rebuild — must be encoded in Universal Business Language 2.1 XML. Your software must generate this format internally; converting a PDF to XML after the fact does not satisfy the requirement.
• Cryptographic signing with CSID: Each invoice must be digitally signed using an elliptic-curve private key tied to your Cryptographic Stamp Identifier certificate. The CSID is device-specific — if you have two tablets at your service desk, each needs its own CSID.
• Invoice Counter (ICV): Every invoice must carry a sequential invoice counter that never repeats, never skips, and never resets. Gaps in the ICV sequence are treated as potential fraud by ZATCA.
• QR code with TLV encoding: The QR code on every printed or digital invoice must be encoded in Tag-Length-Value (TLV) format containing your seller name, VAT number, invoice timestamp, totals, and hash. This is structurally different from Phase 1 QR codes.
• Real-time API submission to Fatoorah: B2B invoices require clearance mode — submitted before the customer receives any copy. B2C invoices use reporting mode — submitted within 24 hours of issuance.
• Offline resilience: ZATCA's specification allows for offline operation during internet outages, but your system must continue generating cryptographically valid signed invoices locally and sync them automatically when connectivity is restored. In a busy workshop service bay, losing the ability to invoice mid-job because your router went down is not acceptable — and not compliant.
• Multiple VAT rates: Workshop invoices typically combine labour (standard 15% VAT), spare parts (standard 15% VAT), and in some cases zero-rated or exempt items. Your system must handle line-item VAT rates and aggregate them correctly in the UBL XML.

Invoice Types Auto Workshops Must Handle

One of the most common compliance mistakes among Saudi workshops is applying a single invoice type to all customers. Phase 2 requires different treatment depending on who your customer is.

B2C Simplified Invoice — Individual Car Owners

When an individual car owner brings their vehicle in for service, ZATCA treats this as a Business-to-Consumer transaction. The simplified invoice does not require the buyer's VAT number. Under Phase 2, simplified invoices operate in reporting mode: your software issues the signed invoice immediately and has a 24-hour window to report it to the Fatoorah portal. The invoice is valid and can be handed to the customer before ZATCA confirmation arrives. This covers the vast majority of workshop transactions — personal vehicles, walk-in customers, and private individuals paying for repairs, tyres, or maintenance services.

B2B Standard Invoice — Fleet and Corporate Customers

When your customer is a fleet company, taxi operator, rental agency, government department, or any other VAT-registered business, the invoice is a Business-to-Business standard invoice. The buyer's VAT number is mandatory on the invoice. B2B invoices operate in clearance mode: your software submits the XML to the Fatoorah portal first, receives a clearance stamp, and only then can the invoice legally be delivered to the buyer. If you issue an uncleaned B2B invoice to a fleet client, that client cannot claim input VAT on the purchase — a significant commercial problem for any workshop serving corporate fleets.

Credit Notes for Warranty Claims and Corrections

When a repair is under warranty, when a part is returned, or when an invoice needs correction, you must issue a ZATCA-compliant credit note. Credit notes under Phase 2 are not simple PDFs — they must reference the original invoice's UUID (the unique identifier assigned at clearance), maintain the hash chain, and be submitted through the same Fatoorah process as the original invoice. A common workshop mistake is issuing a simple refund receipt or handwritten credit note; these do not satisfy Phase 2 requirements and expose you to a separate non-compliance penalty.

15-Step ZATCA Phase 2 Compliance Checklist for Auto Workshops

What ZATCA Phase 2 Costs Your Workshop If You Don't Comply

ZATCA's penalty framework for e-invoicing non-compliance is structured and enforced. The first time ZATCA identifies that your workshop is issuing non-compliant invoices, you receive a written warning with a 30-day correction window. After that, the financial penalties apply per violation, not per audit cycle.

• Issuing non-compliant invoices: SAR 1,000 to SAR 10,000 per violation. Each invoice that is not correctly signed, formatted, or submitted is a separate violation. A workshop issuing 20 invoices per day for a month of non-compliance faces potential exposure of SAR 200,000 to SAR 6,000,000.
• Failure to submit invoices via Fatoorah: SAR 5,000 to SAR 50,000 per violation. This applies when invoices are generated but not submitted through the API at all.
• Full integration non-compliance (operating without any Phase 2 integration after your wave date): Up to SAR 50,000 and potential suspension of your tax registration.
• Commercial impact on B2B customers: Any fleet or corporate customer who receives a non-compliant invoice from your workshop cannot claim input VAT on that purchase. This makes your workshop commercially unattractive to any VAT-registered business customer — a significant revenue risk if you service fleets or rental companies.

For a more detailed breakdown of the penalty schedule and how ZATCA calculates fines across multiple violations, see the compliance penalty guide published at ai.gulfunionozone.com.

The cost comparison is stark: StartPOS Workshop features and pricing starts at SAR 7,500 as a one-time license — less than the minimum first-offense penalty for full integration non-compliance, and a fraction of ongoing exposure if you continue issuing non-compliant invoices.

How StartPOS Workshop Handles ZATCA Phase 2 for You

Most workshop owners are not IT professionals, and ZATCA's technical specification is not written for non-specialists. StartPOS Workshop is built specifically for Saudi auto workshops, and ZATCA Phase 2 integration is handled end-to-end by Gulf Union Ozone's team — not outsourced to a third-party integrator you've never met.

CSID issuance handled directly: Gulf Union Ozone manages the Fatoorah device registration and CSID issuance process as part of your onboarding. You do not need to engage an IT consultant or navigate the portal's technical API documentation yourself. Our team completes this during setup.

Single-day go-live: WhatsApp us at +966 50 197 1075, we get your credentials, configure your workshop profile, and you issue your first ZATCA-compliant invoice on the same day. The typical onboarding-to-first-live-invoice timeline is one business day.

Automatic offline mode with sync on reconnect: StartPOS continues issuing cryptographically signed, sequentially numbered invoices even when your broadband drops mid-service. The queue syncs automatically the moment connectivity returns. Your service bays never stop. Your compliance chain is never broken.

Both B2C and B2B modes built in: StartPOS automatically detects whether an invoice requires simplified reporting mode or clearance mode based on whether you enter a buyer VAT number. No manual mode switching, no risk of using the wrong type.

Credit notes with automatic UUID reference: When you process a warranty return or correction in StartPOS, the system automatically links the credit note to the original invoice UUID and maintains the hash chain. You do not need to look up or manually enter the original invoice reference.

WhatsApp PDF delivery immediately after ZATCA clearance: Once an invoice is cleared or reported, StartPOS sends the PDF to your customer's WhatsApp number automatically. Your customer gets a compliant invoice faster than any paper alternative, and you get a delivery confirmation in the system.

Pricing: SAR 7,500 one-time license (Starter). SAR 10,000 (Professional). SAR 15,000 (AI Pro, includes AI analytics). Annual hosting at SAR 1,200/year. No per-invoice fee. No monthly subscription. Compare this to SaaS alternatives that charge SAR 500–800 per month — within three years, StartPOS costs less than most subscription systems cost in year one alone.

Start your 15-day free trial before your wave deadline — no credit card required. Your first compliant invoice can go out today.

Frequently Asked Questions