What does AI triage do in a pharmacy?
It sorts people before a pharmacist looks at them. In practice that covers four jobs. A questionnaire or chatbot gathers a history. A model scores the answers for risk or urgency. A routing rule decides where the request goes: a Pharmacy First consultation, a prescriber, a decline, or the pharmacist now. And a drafting layer writes up the notes. Vendors bundle these as one product, but the regulators treat them very differently, so pull them apart before you buy.
The first and last of those jobs are administrative. Collecting answers and drafting text does not change what a clinician decides. The middle two are clinical. Scoring a symptom set, or deciding that a patient is unsuitable for a medicine, is a judgement about disease and treatment. The law regulates software that makes that judgement. That distinction runs through everything below. Our guide to how AI is actually used in pharmacy software covers the administrative uses in detail; this article is about the clinical ones.
When does a triage tool become a medical device?
When its maker intends it to inform diagnosis or treatment. The Medical Devices Regulations 2002 (SI 2002/618) define a medical device as "any instrument, apparatus, appliance, software, material or other article" with a medical purpose. The purposes listed include "diagnosis, prevention, monitoring, treatment or alleviation of disease", and the manufacturer's intention decides. Software has sat inside that definition since the regulations were made. There is no AI exemption and no pharmacy exemption.
The test is intended purpose, not technology. Regulation 2 defines intended purpose by the data the manufacturer supplies: the labelling, the instructions and the promotional materials. The MHRA's guidance on crafting an intended purpose, published 22 March 2023, says the statement is read objectively and that marketing claims form part of it. A vendor that sells its tool as "clinically safe triage" has, in the regulator's eyes, described a medical device. The MHRA's guidance on stand-alone software and apps, last updated 1 July 2023, walks through the same decision step by step.
The table applies that test to the functions pharmacies are being sold. The status column is a reading of the UK MDR 2002 definition and the MHRA guidance above. It is not an MHRA ruling on any product.
| Function | Likely status | Why |
|---|---|---|
| Booking, queue management, reminders | Not a device | No medical purpose. It sorts appointments, not patients. |
| Questionnaire that records answers and shows them to the pharmacist unchanged | Generally not a device | It stores and communicates data. The clinician makes every judgement. |
| Symptom checker that outputs an urgency level or a probable condition | Device | The output is diagnosis or triage of disease, which is a medical purpose. |
| Scoring engine that marks a patient suitable or unsuitable for a medicine | Device | It informs a treatment decision. The intended purpose is clinical. |
| Order screening that flags duplicate accounts or unusual quantities | Depends on the claims | Fraud and volume checks are administrative. Clinical interaction warnings lean towards a device. |
| Note drafting from a recorded consultation | Under MHRA review | Documentation alone is not a medical purpose. Summaries that suggest actions may cross the line. |
The last row is live. TORTUS, an automated clinical documentation tool, joined the MHRA's AI Airlock sandbox in October 2025 to test exactly when documentation support becomes decision support that needs classifying. If the regulator is still working that out for an NHS-scale supplier, a pharmacy vendor's confident "not a device" deserves a written justification. Our companion piece on whether consultation questionnaires are medical devices covers the questionnaire end of the spectrum.
What must a device-grade triage tool have?
A conformity mark, an MHRA registration and a live safety system. The MHRA's page on regulating medical devices in the UK, updated 20 February 2026, sets out the Great Britain route. The manufacturer must UKCA mark the device against the UK MDR 2002, or rely on a CE mark within the transition windows. All devices must be registered with the MHRA before they are placed on the Great Britain market. A manufacturer outside the UK must appoint a single UK Responsible Person. Non-sterile, non-measuring Class I devices can be self-certified by the manufacturer; higher classes need a UK Approved Body. The table summarises the rules from that page.
| Requirement | Rule | Date |
|---|---|---|
| UKCA marking | Manufacturer attests conformity with the UK MDR 2002. | In force. |
| CE marking, EU directive devices | Accepted in Great Britain. | Until the sooner of certificate expiry or 30 June 2028. |
| CE marking, EU Medical Device Regulation devices | Accepted in Great Britain. | Until 30 June 2030. |
| MHRA registration | All devices, all classes, before placing on the market. UK Responsible Person if the maker is overseas. | In force. |
| Post-market surveillance | Strengthened vigilance and incident reporting duties for manufacturers. | In force 16 June 2025. |
| Future rules | Government to consult on indefinite recognition of CE marked devices. | Announced, no date. |
Two points matter for pharmacies. First, registration is not approval. The MHRA registers the manufacturer and the device type; it does not test the software. Second, self-certification means a Class I vendor has written its own technical file, so ask to see a summary of it. The post-market surveillance regulations in force since 16 June 2025 also mean a device manufacturer must collect incident data from users like you. Ask how.
AI adds a layer. The MHRA, the US FDA and Health Canada published ten guiding principles of good machine learning practice on 27 October 2021. Two speak directly to triage. One says "focus is placed on the performance of the human-AI team". Another says "deployed models are monitored for performance and retraining risks are managed". A vendor that cannot show a monitoring plan for a model that changes has not met the regulators' own baseline.
Who is accountable when the AI gets it wrong?
The pharmacist, then the pharmacy owner, then the manufacturer, in that order of exposure. The GPhC published a position statement on the use of AI in pharmacy in April 2026. It says pharmacy professionals remain "personally accountable for their professional practice, even when AI is being used". They must "always be prepared to justify their decisions and actions, explaining how they have exercised their professional judgement". And it states plainly that "AI should not replace clinical decision making and professional judgement".
That restates the 2017 standards for pharmacy professionals. Those say professionals "are personally accountable for meeting the standards and must be able to justify the decisions they make". Standard 5 requires them to "use their judgement to make clinical and professional decisions with the person or others". A triage score is information the pharmacist weighs. It is never a decision the pharmacist can point to afterwards.
The owner carries the governance. The GPhC's statement asks pharmacy owners to "carry out due diligence to make sure AI tools are safe, appropriate and used in line with their intended purpose". It asks for "suitable training, so staff understand the system and its limitations". Those duties already sit in the 2018 standards for registered pharmacies. Standard 1.1 requires risks to be identified and managed. Standard 4.2 requires services to be "managed and delivered safely and effectively". Standard 5.2 requires equipment to be "safe to use and fit for purpose". The statement also draws the boundary. "The GPhC does not have a role in regulating AI tools/products or in assessing their clinical safety or technical performance." That job is the MHRA's.
The manufacturer answers for the product. Under regulation 61 of the UK MDR 2002 the Secretary of State, acting through the MHRA, has a duty to enforce the regulations. Regulation 60 lets a UK Responsible Person be proceeded against as the person who placed the device on the market. That protects patients. It does not protect a pharmacist who acted on an output they could not justify. The NHS clinical safety standards add a deployment duty of your own, which our guide to DCB0160 for pharmacies explains.
Can AI decide who gets a medicine online?
No. It can screen and flag; a registered prescriber must decide. The GPhC's February 2025 guidance for pharmacies providing services at a distance says "some medicines are not suitable to be prescribed by a questionnaire model alone". For those categories the prescriber must independently verify what the patient says, and there must be "timely two-way communication" between prescriber and patient. For weight management medicines the guidance is blunter still. It says a phone call "would not be appropriate" as a way of verifying information when supplying medication for weight loss. An algorithm reading the same questionnaire cannot satisfy a rule written to stop reliance on the questionnaire.
The same guidance does expect automation, in its place. Pharmacies should use automated systems to warn staff about inappropriate requests. The examples it gives are multiple orders to one address, one person using several accounts, and orders from different people on the same payment details. It adds inappropriate medicine combinations, repeated requests for infection remedies, and orders that are too large or too frequent. That is a screening job AI does well, and the regulator asks for it. The GPhC's guidance for pharmacist prescribers, updated April 2025, closes the loop from the prescriber's side. Prescribers "must not make prescribing decisions for high-risk medicines based on online questionnaires alone with no access to the person's medical history or consent to contact the person's regular prescriber".
So the workable design is settled. AI can decline the obviously ineligible, escalate the obviously urgent and rank the rest, provided every clinical decision is taken and recorded by a named professional. Our guides to the verification duties for weight-loss supply and to designing a compliant consultation flow show where the human steps belong.
What is the MHRA doing about AI in 2026?
Testing products in a sandbox and rewriting the framework. The AI Airlock, the MHRA's regulatory sandbox for AI as a medical device, opened in spring 2024. Its pilot ran to April 2025 and the programme report followed on 16 October 2025. The same day the MHRA named a second cohort of seven products across three regulatory challenges. Two sit close to pharmacy work. Numan's tool explains blood test results to patients in plain language. DeepX AI analyses skin lesion images and gives triage recommendations. In April 2026 funding of £3.6 million over three years was approved to keep the sandbox running.
Above the sandbox sits the National Commission into the Regulation of AI in Healthcare. The MHRA launched it on 26 September 2025. Professor Alastair Denniston chairs it, with Professor Henrietta Hughes, the Patient Safety Commissioner for England, as deputy chair. It ran a call for evidence from December 2025 to February 2026 and is due to publish recommendations for a new regulatory framework during 2026. Until it does, the UK MDR 2002 and the guidance above are the rules. The MHRA has also said the government will consult on recognising CE marked devices indefinitely. Nothing in the pipeline removes the pharmacist's accountability. Every published principle so far assumes a human in the loop.
How do you deploy AI triage safely?
Treat it as a clinical system change, not a software update. The checklist below combines the MHRA's device requirements, the GPhC's April 2026 statement and the NHS clinical safety standards. Our guide to what to ask suppliers about DCB0129 covers the supplier side in more depth.
- Get the manufacturer's statement of intended purpose in writing, and check the marketing matches it.
- Ask which class the device is and who certified it, and see the UKCA or CE certificate. For a Class I self-declaration, ask for a technical file summary.
- Check the manufacturer on the MHRA's Public Access Registration Database, remembering that registration is not approval.
- Obtain the supplier's DCB0129 clinical safety case and hazard log, then complete your own DCB0160 assessment with a named clinical safety officer.
- Write the human-in-the-loop rule into the SOP: which outputs a pharmacist must review, and how an override is recorded.
- Confirm every triage output and override is stored in the patient record with a timestamp.
- Tell patients where AI is used, and record consent where the GPhC's statement requires it.
- Agree a monitoring plan for model updates, and report faults to the vendor and through the Yellow Card scheme.
- Train every user on the tool's limits, and keep a manual pathway that works when the system is down.
Buy triage that surfaces, not triage that decides. If a vendor's demo ends with the software declining a patient or approving a supply, ask who signed that decision. If the answer is "the model", the product either needs a medical device certificate it may not have, or has removed a pharmacist step the GPhC expects. Either way the accountability lands on your registration, not the vendor's.
Key takeaways
- Software that scores or sorts patients by clinical risk meets the UK MDR 2002 definition of a medical device once its maker intends it to inform diagnosis or treatment. AI gets no exemption.
- Intended purpose is read from labelling, instructions and marketing, so a vendor's "clinically safe triage" claim is a regulatory statement.
- A device needs UKCA marking or an accepted CE mark (until 30 June 2028 or 30 June 2030), MHRA registration and, since 16 June 2025, strengthened post-market surveillance.
- The GPhC's April 2026 position statement keeps pharmacy professionals personally accountable and says AI "should not replace clinical decision making and professional judgement".
- The GPhC's February 2025 distance-selling guidance bars questionnaire-only prescribing for higher-risk medicines, and an algorithm reading the questionnaire does not change that.
- The MHRA's AI Airlock and the National Commission launched on 26 September 2025 are rewriting the rules, with recommendations due in 2026.
- Deploy triage under DCB0160 with a named clinical safety officer, a written human-in-the-loop rule and an audit trail of every output and override.
Sources and further reading
- Medical Devices Regulations 2002, regulation 2: definition of a medical device (legislation.gov.uk)
- Software and artificial intelligence (AI) as a medical device (MHRA)
- Regulating medical devices in the UK (MHRA, updated 20 February 2026)
- National Commission into the Regulation of AI in Healthcare (MHRA)
- Position statement on the use of artificial intelligence in pharmacy (GPhC, April 2026)
- Guidance for registered pharmacies providing services at a distance (GPhC, February 2025)
- Standards for registered pharmacies (GPhC, June 2018)
FAQs
Keep the decision with the pharmacist.
Dataforge PMR records the consultation, the flags and the pharmacist's decision in one patient timeline, so an inspector can see who decided what. Whatever system you use, make sure AI outputs and overrides land in the patient record.
See Dataforge PMR