Mutabiq checks Saudi ZATCA Phase 2 e-invoice XML before you submit it: pre-validation against published ZATCA requirements, not an approval by the authority. This page explains one rule, BR-KSA-70.
Five checks a month on the Free plan. The file is checked in memory and is never stored.
The message ZATCA prints
[BR-KSA-70]-The invoice must contain Invoice Issue Time (KSA-25). This value should be in the format: hh:mm:ss for time expressed in local time (eg 19:20:30) or hh:mm:ssZ for time expressed in UTC (eg 19:20:30Z)."The invoice must contain Invoice Issue Time (KSA-25). This value should be in the format: hh:mm:ss for time expressed in local time (eg 19:20:30) or hh:mm:ssZ for time expressed in UTC (eg 19:20:30Z).
What Mutabiq reports
One entry for each way this rule can be reported.
Reported as
What kind of value was found — empty, not_15_digits and the like — never the value itself.
Issue time is missing
Reported asissue_time_missingthe issue time is missing
What is wrong
The invoice has no cbc:IssueTime (KSA-25). ZATCA rejects the document under BR-KSA-70, which requires the issue time on every invoice, written as hh:mm:ss in local time or hh:mm:ssZ in UTC.
What to check in your ERP
Map the time the invoice was issued into cbc:IssueTime, directly after cbc:IssueDate.
Issue time is not written as hh:mm:ss
Reported asissue_time_bad_formatnot written as hh:mm:ss
What is wrong
cbc:IssueTime is present but is not a time of day written as hh:mm:ss (for example 19:20:30) or hh:mm:ssZ (19:20:30Z). ZATCA rejects the document under BR-KSA-70. Fractions of a second, a time zone offset such as +03:00, a missing seconds field and spaces around the value all fail this check, even where the XML schema would accept them.
What to check in your ERP
Write the time with two digits each for hours, minutes and seconds, in 24-hour form, and nothing else. Timestamps copied from a database often carry milliseconds or an offset; strip them when the XML is written.
The clause that runs
Quoted from the validation-rule stylesheet ZATCA publishes, at the file and line named below. The executed guard is what the check runs; the reported test is what it prints when it fails, and the two are not always the same.
Executed guard
not(exists(cbc:IssueTime) and (cbc:IssueTime) != '' and (matches(cbc:IssueTime, '^([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9])$') or matches(cbc:IssueTime, '^([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9])Z$')))
Reported test
exists(cbc:IssueTime) and (cbc:IssueTime) != '' and (matches(cbc:IssueTime, '^([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9])$') or matches(cbc:IssueTime, '^([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9])Z$'))
As shipped in ZATCA SDK 3.4.8: the copy quoted here is, byte for byte, the file that release ships. The date in the file name is the name ZATCA gives the file; the rules in it are those of SDK 3.4.8.
A worked example
A synthetic document from the measured test corpus that trips this rule, shown where it differs from one that passed. Mutabiq's report names the class of the value, never the value itself.
Where it differs from a document that passed
− This example
+ A document that passed
<cbc:UUID>3cf5ee18-ee25-44ea-a444-2c37ba7f28be</cbc:UUID><cbc:IssueDate>2026-09-01</cbc:IssueDate>−This example: <cbc:IssueTime>10:00:00.0000000000000000000</cbc:IssueTime>+A document that passed: <cbc:IssueTime>10:00:00</cbc:IssueTime><cbc:InvoiceTypeCode name="0100000">388</cbc:InvoiceTypeCode><cbc:DocumentCurrencyCode>SAR</cbc:DocumentCurrencyCode>