Last reviewed: 30 October 2026 · Riv-ERP team
General information, not tax advice. The final reference is the Zakat, Tax and Customs Authority guides and its direct notices to your business.
Need ZATCA Phase 2 e-invoicing?
Issue compliant tax and simplified invoices and integrate with Fatoora from your accounting system.
Learn more Request a quote
The Short Answer
Yes, a system running on a server inside your business can connect to the Fatoora platform. Phase 2 does not require your system to be cloud-based. What it requires is that the system meets the technical requirements: generating the invoice in XML, signing it with a certificate issued by the Authority, and sending it through the integration within the required time. The Authority’s detailed technical guideline mentions both cases explicitly: with a central server, whether on premise or cloud, a CSID certificate is needed on the server (Detailed Technical Guideline, Zakat, Tax and Customs Authority).
So the real question is not “cloud or desktop” but: can your current system meet these requirements, and is there someone to keep it updated?
Why Does This Matter Now?
On 24 July 2026 the Authority announced the criteria for Wave 25 of the integration phase. This wave covers businesses whose VAT-taxable revenue exceeded SAR 187,500 in any of the years 2022, 2023, 2024 or 2025, and the set date is 1 February 2027. Targeted businesses will be notified directly (the Authority’s announcement).
This wave includes many small businesses that have run on desktop software for years, which is why the question keeps coming up: do I have to change my software? To check whether your business qualifies: E-invoicing Wave 25: the SAR 187,500 threshold.
What Does Phase 2 Require from Any System?
Standard tax invoice (B2B): clearance before delivery
The system sends the invoice to the platform for clearance before handing it to the buyer. A standard invoice is not valid until it is cleared (Technical Guideline).
Simplified invoice (B2C): reporting within 24 hours
The simplified invoice is handed to the customer at once, and the system reports it within 24 hours of completing the transaction (same source).
Format, signature and QR code
The invoice is created and stored as XML, or as PDF/A-3 with the XML embedded, with the additional Phase 2 fields. The solution must be able to connect to the internet (the “How to Prepare” guide). The invoice is cryptographically stamped and a QR code is added according to the specifications published on the e-invoicing specifications page.
Is It Different If the System Runs on Your Own Server?
The requirements are the same. The difference is where the certificate is kept and who manages the connection:
| On-premise system (your server) | Cloud system | |
|---|---|---|
| Where the certificate (CSID) is installed | On your server or on each issuing unit | On the vendor’s server |
| Connection to the Fatoora platform | From your network to the internet | From the vendor’s data center |
| Responsibility for keeping the connection up | Yours (or your support team’s) | Usually the vendor’s |
| Where invoice data lives | Inside your business | With the vendor |
| Updates when specifications change | Installed by the vendor on your server | Applied centrally |
The technical guideline also indicates that the certificate is per independent document sequence. If each cashier device issues its own sequence, it most likely needs its own certificate. Settle this point with your system vendor before onboarding.
Steps to Connect from an On-Premise System
Before you start
- Confirm your business is in a mandated wave, and note its date.
- Ask your system vendor a direct question: does my current version support Phase 2? and ask for a written answer.
- Prepare a stable internet connection for the server or the issuing devices.
- Define the issuing units: one central server, or several cashier devices each with its own sequence?
Onboarding on the Fatoora portal
According to the Authority’s guides, the process goes through these stages (How to Prepare andTechnical Guideline):
- Log in to the Fatoora portal and generate an OTP code (valid for one hour).
- Enter the code in your system so it creates the certificate signing request (CSR) with the required data.
- Obtain the Compliance CSID and pass the compliance checks.
- Obtain the Production CSID and start issuing live invoices.
Operation and follow-up
- Review the first batch of invoices: did the standard ones reach cleared status, and were the simplified ones reported?
- Assign someone to follow rejected or pending invoices daily in the first weeks, and go through the most common XML validation errors with your vendor.
- If the integration goes down, the technical guideline directs you to clear or report the transactions of the outage period once the fault is over, and states that the aim is for consumer transactions not to stop because of technical faults. Plan this scenario with your vendor in advance.
Upgrade or Replace? A Decision Table
| Question | If the answer is yes | If the answer is no |
|---|---|---|
| Does your current system generate XML to the specifications and sign it? | Upgrade is possible | Most likely replace |
| Does the software have an active vendor releasing Phase 2 updates? | Ask for the upgrade plan and date in writing | Risk: nobody will update it when specifications change |
| Does it support a certificate per issuing unit or for the central server? | Continue | Ask about the alternative before onboarding |
| Does it send the standard invoice for clearance before printing it for the customer? | Continue | Replace, or use a middleware solution |
Middleware solutions (software that takes the invoice from your old system and sends it to the platform) exist, but they add a third system for you to follow. Compare their cost and risks with the cost of upgrading the system itself. For general preparation: Checklist: is your accounting system ready for ZATCA integration?
A note when choosing a vendor: the list of solution providers on the Authority’s website is for guidance only. The Authority states that the list is not an accreditation of technical solutions, and that the taxpayer may obtain the service from any company whose system meets the requirements (list of solution providers). So ask about what the system can do, not about logos.
Common Mistakes When Connecting an On-Premise System
- Onboarding before settling the unit structure. If you register one server and then find that the cashier devices issue independent sequences, you will redo the work. Draw the structure first: who issues the invoice, and from which device?
- Relying on one internet connection with no backup. A standard invoice needs clearance before delivery, so if the connection drops, delivery to the customer is delayed. A simple backup connection (a data SIM, for example) reduces this effect.
- Leaving certificates without an owner. The certificate is tied to your business and to the issuing unit. Decide who manages certificates in your business, and ask your vendor when they must be renewed or reissued, for example when changing the server or adding a device.
- No one responsible for rejected invoices. Invoices may be rejected in the first days for reasons such as missing data in the customer file, like the tax number or address. Assign someone to review them daily.
- Updating the system on one device and forgetting another. In on-premise environments with more than one issuing device, all devices must be on the same version that supports Phase 2.
- Neglecting backups. Invoice data on your server means keeping it safe is your responsibility too. Set a backup schedule and test restoring, and review the archiving requirements in electronic archiving of invoices.
How RivDesktop Handles Phase 2
RivDesktop is an ERP and accounting system that runs on your server (.NET on Windows with SQL Server), and its data stays inside your business. For e-invoicing the system covers:
- Issuing the certificate (CSID) and signing the invoice.
- QR code and XML file.
- Both paths: Clearance for standard invoices andReporting for simplified ones.
- The VAT return with its 16 boxes, the Hijri date and the new riyal symbol.
- Permissions down to field level, and a change log showing who edited what and when.
RivDesktop is licensed with perpetual ownership, so you do not need to move to a cloud subscription to comply with Phase 2. For the steps inside the system: E-invoicing in RivDesktop step by step. And for the product page: RivDesktop.
Frequently Asked Questions
Does my system have to be cloud-based to connect to the Fatoora platform?
No. The Authority’s technical guideline mentions on-premise and cloud servers together, and in both cases requires a certificate on the server. What matters is that the system meets the technical requirements and can connect to the internet.
Do I need a certificate for every cashier device?
It depends on the system structure. If each device issues an independent document sequence, the guideline points to a certificate per sequence. If invoices are issued from a central server, the certificate is on the server. Settle this with your vendor before onboarding.
What if the connection drops at the moment of issuing the invoice?
A simplified invoice has a reporting window of up to 24 hours from completing the transaction. A standard invoice needs clearance before it is handed to the buyer. When the integration is down, the technical guideline directs you to process the outage-period transactions once the fault is over. Agree a clear procedure for this case with your vendor.
Is your on-premise system ready before 1 February 2027? Book a demo of connecting RivDesktop to the Fatoora platform, or contact us at info@riv-erp.com.
See Riv-ERP in action
Two editions: RivDesktop on your own server, or Riv-ERP Cloud on Oracle Cloud.
Book a demo
