ERP and Saudi Compliance: E-Invoicing, VAT, and Arabic Localization

In part seven we turned the lessons of failure into an execution plan: discovery, migration, testing, and go-live. But before all of that — before selection and before implementation — stands one condition that cannot be deferred in Saudi Arabia: compliance. An ERP that does not comply with Saudi regulations is not a system you customize later; it is a system you cannot legally run. In this eighth part we lay out the compliance checklist you must demand from any system before signing: e-invoicing, VAT, full localization, data residency, and payroll. Demand them as hard requirements, not add-ons that arrive after the sale.

E-invoicing (Fatoora): two phases, not optional

E-invoicing is a mandate from the Zakat, Tax and Customs Authority (ZATCA), not an added feature, and it comes in two phases the system must cover:

• The generation phase: mandatory since 4 December 2021. Every taxable business must issue its invoices and notes in a structured electronic format — not by hand, not in an ordinary editor — with a QR code on the simplified invoice.
• The integration phase: began on 1 January 2023 and rolls out in waves. Here the system connects directly to the Fatoora platform: the standard tax invoice, business to business, is sent to the authority for clearance before it is shared with the buyer, and the simplified invoice, to the consumer, is reported within 24 hours — with a cryptographic stamp, a unique identifier, and a specific XML format.

And the scope keeps widening downward, not upward: wave 24 — with a 30 June 2026 deadline — dropped the threshold to SAR 375,000 of annual revenue, bringing thousands of small and medium enterprises into the second phase. The line we are too small is no longer an exit. So demand a system already integrated and approved with the authority today, not one that promises integration later.

VAT: correct calculation and ready returns

The standard VAT rate is 15%, and a good system calculates it correctly on every transaction rather than leaving it to you by hand. Require it to distinguish the standard tax invoice from the simplified one at the SAR 1,000 threshold, to handle exempt and zero-rated items, to retain invoices and records for six years as the regulation requires, and to produce your VAT return ready to file — not a pile of numbers you reassemble yourself. A system that gets tax wrong does not just cost you effort; it exposes you to penalties.

Full localization: Arabic, RTL, and the Hijri calendar

Localization is not an Arabic-language button bolted onto an English interface. It is a fully right-to-left interface, invoices and reports in Arabic as the authority requires on the tax invoice, and a Hijri calendar alongside the Gregorian one — because here contracts, salaries, and official dates run on Hijri. A system Arabized late betrays itself in the details: a report with broken direction, a field that appears only in English, a date in Gregorian only. Demand localization built into the core of the system, not translated onto its surface.

Data residency and privacy: the PDPL and SDAIA

Your system holds personal data of your customers, employees, and suppliers, and that is governed by the Personal Data Protection Law (PDPL), overseen by the Saudi Data and Artificial Intelligence Authority (SDAIA), fully enforceable since 14 September 2024 on anyone processing the data of individuals in Saudi Arabia. Before signing, ask: where does my data actually reside? A cloud system hosted outside the Kingdom triggers the rules on transferring data across borders, which require appropriate protection in the receiving party. Ask too about the legal basis for processing, the technical safeguards, and your ability to respond to data-subject rights. Data residency and PDPL alignment are a hard requirement, not a technical detail to defer.

Payroll: wage protection and social insurance

If the system runs payroll and HR, it must connect cleanly to the national systems: the Wage Protection System, which requires wages to be paid through approved channels with wage files uploaded, and the General Organization for Social Insurance (GOSI), with contributions calculated correctly. Payroll that does not feed wage protection and social insurance smoothly turns into manual re-entry every month — the very spreadsheet pain the system came to end.

The Origami view

At Origami we are a technology company serving Saudi businesses, and we treat compliance as a foundation, not a feature. We do not ask whether it can be Arabized later; we require, before anything else: second-phase integration with ZATCA, correct VAT calculation, full Arabic, RTL, and Hijri, data handling aligned with the PDPL, and clean ties to wage protection and social insurance. Because a system that stumbles on compliance is not a system that saves your time; it is a new source of risk added to your business.

Conclusion

Compliance in Saudi Arabia is not the last item on the list but the first gate. Before you weigh features or price, demand the full checklist: e-invoicing across both phases, correct VAT and ready returns, Arabic and RTL and Hijri, data residency aligned with the PDPL under SDAIA, and payroll tied to wage protection and social insurance. The absence of any one of these turns an ERP from a tool of order into a source of violation. And having secured the ground of compliance, in the ninth and final part we lift our eyes to where systems are heading: artificial intelligence in modern ERP, and how it changes the way you run your business and question it.

Sources

• Zakat, Tax and Customs Authority (ZATCA) — E-invoicing (Fatoora) across both phases and the 15% VAT rate: https://zatca.gov.sa
• Saudi Data and Artificial Intelligence Authority (SDAIA) — the Personal Data Protection Law: https://sdaia.gov.sa
• General Organization for Social Insurance (GOSI) — contributions and payroll integration: https://www.gosi.gov.sa
• Saudi Vision 2030 — digital transformation and enabling small and medium enterprises: https://www.vision2030.gov.sa