ZATCA-Approved E-Invoicing Software for Saudi Arabia: What the List Really Means

ZATCA Phase 2 Wave rollouts are tightening the net around more Saudi businesses each quarter, and procurement teams are searching for a definitive "approved software list" — a ZATCA registry of vetted ERP brand names they can consult before choosing a system. That registry does not exist. ZATCA certifies the specific e-invoicing solution of a specific business entity, not ERP product lines. Understanding this distinction is the difference between a compliant go-live and a B2B clearance failure on day one.

This guide explains the certification mechanics — the three-stage CSID process, the six technical requirements that Phase 2 mandates, where Odoo stands in this certification model, and a four-step framework for verifying any vendor's compliance claim before you sign a contract.

What does 'ZATCA-approved' actually mean for e-invoicing software?

ZATCA does not maintain a registry of approved ERP brands. What ZATCA evaluates and certifies is the specific e-invoicing solution — the exact configuration of a specific business entity. The certification binds a Taxpayer Identification Number (TIN) to a specific device and solution configuration, not to an ERP product line. A buyer cannot look up "Odoo" or any other system on a ZATCA whitelist and rely on that lookup as proof of compliance for their own entity.

What technical requirements must e-invoicing software meet for ZATCA Phase 2?

ZATCA's technical specification for Phase 2 mandates six specific capabilities. Any e-invoicing solution — whether embedded in an ERP or standalone — must implement all six to pass the Compliance CSID process. These are the objective criteria to audit when evaluating a vendor's Phase 2 readiness claim.

Does Odoo qualify for ZATCA Phase 2 — and what does iWesabe's track record show?

Odoo 16, 17, and 18 ship with two Saudi-specific modules in the standard distribution: l10n_sa (Saudi localisation — VAT, chart of accounts, TIN) and l10n_sa_edi (electronic invoicing — UBL 2.1 XML generation, ECDSA stamping, UUID, TLV QR code, and the ZATCA clearance/reporting API). No third-party add-on is required. These modules implement all six Phase 2 technical requirements in the table above as part of the core Odoo distribution.

iWesabe has completed ZATCA Phase 2 Compliance CSID and Production CSID processes for Saudi clients across manufacturing, distribution, retail, and professional services — in multiple Wave batches. Each go-live involved ZATCA sandbox onboarding, compliance invoice testing, CCSID issuance, and production clearance confirmation for the client's specific TIN and entity.

What should you look for beyond ZATCA certification when choosing an e-invoicing system?

Passing ZATCA certification is the minimum bar, not the complete evaluation. A solution that clears the Compliance CSID process may still carry operational risk if it was not built to handle live Saudi invoicing at scale. Five criteria worth adding to your vendor evaluation:

• Wave-specific implementation references — "Phase 2 capable" is a vendor claim; a completed Production CSID for a client in your specific Wave is evidence.
• Rejection diagnostic capability — can the team diagnose B2B clearance rejections by ZATCA error code (XML structure, ECDSA stamp, ICV sequence, customer classification, VAT mismatch)?
• ZATCA API downtime handling — ZATCA's Fatoora portal has planned and unplanned downtime. Does the system queue invoices locally and retry, or does an outage freeze your entire accounts-receivable workflow?
• 7-year archive design — is the signed XML archive built into the ERP storage layer, or is it bolted on to a third-party system that requires a separate maintenance contract?
• Phase 3 upgrade path — ZATCA has indicated scope expansion is coming. Ask specifically how the vendor manages compliance updates between Phase releases without requiring a full re-implementation.

How to verify a software vendor's ZATCA compliance claim before you commit

Once you have identified a candidate system, these four steps convert a vendor's compliance claim into verifiable evidence before you sign a contract:

1. Request the Compliance CSID documentation for a reference client in your Wave — not a generic "we are Phase 2 ready" slide deck. The CCSID document identifies the TIN, solution configuration, and Wave batch.
2. Ask for the first-pass B2B clearance acceptance rate for that reference client in live production. A well-configured Odoo + ZATCA implementation should achieve ≥99% first-pass acceptance; anything below 95% in steady state signals misconfiguration.
3. Request two or three callable references from clients who completed Production CSID in the same Wave you are entering — ask specifically about the certification timeline, ZATCA sandbox interactions, and post-go-live rejection rates.
4. Run a sandbox proof-of-concept before signing — credible implementation partners will demonstrate end-to-end ZATCA clearance in the sandbox environment as part of the pre-sales process. A partner who declines is signalling that their Phase 2 implementation is not production-tested.

The "ZATCA-approved software list" question has a more specific answer than most buyers expect — certification is per-deployment, not per-brand. The six technical requirements, the three-stage CSID process, and the five beyond-compliance criteria above are the working evaluation framework for any Saudi e-invoicing procurement decision.

iWesabe has implemented ZATCA Phase 2 on Odoo for Saudi enterprises across manufacturing, distribution, retail, and professional services. If you are in an active Wave window or planning a ZATCA-compliant go-live, a 60-minute call is sufficient to assess your Wave timeline and current system readiness.

iWesabe Editorial Team

Practitioner insights on Odoo ERP, ZATCA compliance, and Saudi enterprise digital operations — written by iWesabe's consulting, finance, and engineering teams.

About iWesabe