QR Code Requirements for E-Invoicing in Saudi Arabia

QR Code Requirements for E-Invoicing in Saudi Arabia

Introduction

QR code is a required element on all electronic invoices, according to ZATCA e-invoicing regulations. As a machine-readable code, it serves as an important proof mechanism for immediate validation, enabling buyers and authorities to authenticate the invoice and reconfirm that it has not been altered. Its presence on both simplified and standard tax invoices is not optional but a strict compliance requirement for all phases of the mandate. The QR code must contain specific, structured data and adhere to precise technical specifications regarding its size and visibility to avoid significant financial penalties for the issuing business.

Function and Significance of the QR Code

The QR code is the backbone of ZATCA's anti-fraud and compliance scheme. Its two main objectives are therefore to:

• Immediate Verification - Customers and ZATCA officials can scan the code to ensure document crucial details are correct and matched to the presented human-readable line.

• Data Integrity: The inclusion of the Cryptographic Stamp Hash (CSH) in Phase Two directly links the printed invoice to the version cleared and logged with ZATCA. Any manipulation of the invoice data post-clearance will be identifiable.

• Interoperability: It creates a standardized way for all members in a supply chain to access invoice information in the same way, in a machine-readable way.

Required Data Fields within a QR Code

The QR code must include the required data and must be in a structured format, for example, TLV (Tag-Length-Value) or any other structured one. The mandatory fields include:

Field Name	Description
Name of the seller	The legal name of the business that creates the invoice.
Seller Tax Identification Number (TIN)	The VAT registration number.
Invoice Date and Time	The date and time when it was issued with a standard format such as (yyyy-mm-dd hh:mm:ss).
VAT Amount	The computed total VAT for the invoice.
Cryptographic Stamp Hash (CSH)	(Vital in Phase Two) A digital fingerprint is generated by ZATCA's Fatoora portal when the invoice is cleared successfully. This is what makes the invoice authentic and tamper-proof.

 

Technical Specifications

It is not sufficient to design a QR code with the right data; it must be compatible with ZATCA's technical specifications to be scannable with reliability. 

• QR Code Type: Must be a QR Code Model 2.

• Error Correction Level: Must utilize error correction level "M" (15%), which provides a satisfactory trade-off between capacity and damage resistance.

• Character Encoding: Must be UTF-8 encoded in order to support both Arabic and English characters.

• Minimum Size: The printed size of the QR code should be at least 2 x 2 centimeters (20 x 20 mm). It may be larger but not smaller, so that it is easily scannable with various devices.

• Print Quality: The QR code must be printed in high quality so the edges are still sharp and high contrast (typically black on white) for maximum scannability.

Placement on the Invoice

ZATCA stipulates that the QR Code must be "clearly visible" on the invoice. It does not state a particular location (e.g., top, bottom, corner) in the final regulation; however, it is always good practice to position it in a visually striking spatial location that can be seen easily like next to the seller's details or next to the totals on the invoice, and not held behind other items, stamps, and logos.

How is the generation of the QR Code accomplished?

Businesses are not expected to generate these complex QR codes manually. The generation is—and must be—an automated function of your ZATCA-compliant e-invoicing solution. The software will:

• Compile all the required mandatory data fields.

• In Phase Two, first obtain the Cryptographic Stamp Hash from ZATCA.

• Format the data as ZATCA requires (i.e., TLV).

• Create the QR code image as required technically (Model 2, Level M).

• Automatically embed the QR code image onto the final invoice format.

 

What are the common mistakes to avoid?

• Wrong Data: The biggest wrong data mistake seen is mismatched data in the QR code image versus the human-readable sections on the invoice.

• Missing CSH: For Phase Two, having a lack of Cryptographic Stamp Hash will mean that the invoice is not compliant.

• Size Too Small: The QR code should be printed at no smaller than 2x2 cm in order to be scanned.

• Low Contrast/Poor Quality: The QR code must not be skewed black and white in its contrast. It must not be a blurry/pixelated quality QR code. The rule of thumb is that if you cannot scan the QR code, it is non-compliant.

Conclusion

QR code implementation is a very important component of a country's e-invoicing system, developed in conjunction with the QR code, allowing for instant verification and helping deter fraud using an identical, machine-readable format, among others. The QR code must contain explicit seller data, explicit invoice data, explicit tax data, and, dangerously, the Cryptographic Stamp Hash (unlocking ZATCA's platform) in Phase Two, all of which can carry penalties of up to SAR 50,000 for each time of non-compliance.

The key benefits here are transparency and trust in study relationships, which guard firms and buyers. In the end, you want to be able to use a ZATCA-approved e-invoicing solution that will automatically create a fully technically compliant QR code for your invoice.

Do not risk non-compliance and convert money into penalties! Call or email us now for a free consultation with one of our e-Invoicing experts and ensure your invoices comply with the new QR Code laws in Saudi Arabia!

FAQs

1. Do simplified tax invoices require a QR code?

Yes, ZATCA mandates standard and simplified tax invoices to have a compliant QR code. 

2. What happens if the QR code is lost or illegible?

An illegible QR code is as good as none at all and can lead to penalties. The invoice must be reissued with a scannable, readable QR code.

3. Can I create a free online QR code on my invoices?

No. Manual generation is not feasible for compliance. The process requires integration with your e-invoicing system to include dynamic data like the timestamp and, crucially, the Cryptographic Stamp Hash from ZATCA in Phase Two.

4. How is the Phase 1 QR code different from the Phase 2?

During Phase One, static data of the seller was incorporated into the QR code. In Phase Two, it must include the dynamic Cryptographic Stamp Hash (CSH) received from ZATCA during clearance, which links the physical invoice to the official government record.

5. Is there a specific ZATCA QR code scanner?

ZATCA has also released an official "ZATCA Invoice QR Code Reader" app on iOS and Android for businesses and customers to validate invoices. Any standard QR code reader, however, can read the data, but may not parse the TLV structure without dedicated software.

You can explore Flick's other global tax and compliance resources here.