How do you set up a medicinal cannabis dispensing pharmacy in the UK?

What are you actually building?

You are building a registered pharmacy whose entire catalogue is unlicensed Schedule 2 controlled drugs, prescribed by specialists and delivered to patients who never visit. Each element of that sentence carries its own regulatory regime, and the pharmacy is where they stack. This guide is written for the market described in our 2026 market analysis, where the pharmacy layer is both the sector's bottleneck and its moat.

Cannabis-based products for medicinal use (CBPMs) sit in Schedule 2 of the Misuse of Drugs Regulations 2001. Everything the pharmacy holds therefore carries controlled drug requirements, including safe custody and register-keeping. Almost all CBPMs are unlicensed, so supply runs under the specials regime, with its own record-keeping and supply-condition obligations. Prescriptions come only from doctors on the General Medical Council (GMC) Specialist Register, as private prescriptions from Care Quality Commission (CQC) regulated clinics. That makes prescriber verification a core workflow, not an edge case. And the patient base is remote, which makes this a distance selling model under the General Pharmaceutical Council (GPhC) distance services guidance. The twist is that what you ship is a Schedule 2 drug.

None of that changes the legal foundation. A CBPM pharmacy is a registered pharmacy under the Medicines Act 1968, like any other. The ownership rules, the superintendent requirement and the premises registration are exactly those covered in structuring a pharmacy business and the GPhC premises application.

What does the setup sequence look like?

The sequence is the standard distance selling launch, with CD and specials infrastructure built in from the start rather than retrofitted. The honest planning assumption: the specialist layers add cost and evidence weight, not new regulatory gates.

Two sequencing points from experience with regulated launches. First, specify the CD cabinet and the alarm system before you assemble the GPhC evidence pack. Security is the classic further-information trigger, and it bites harder when the application says "medicinal cannabis" on it. Second, open the supply-chain conversations before the premises is finished: importer onboarding, credit terms and product availability move on their own clock.

The general costs and working capital logic in what it really costs to launch an online pharmacy applies here, with a heavier stock line. CBPM stockholding is expensive per item and hostage to import lead times.

What does the controlled drugs infrastructure actually require?

It requires safe custody, registers, compliant prescriptions and disciplined destruction — all evidenced continuously, not assembled for inspection. This is the daily texture of the business, so build it as workflow, not paperwork.

Safe custody. Schedule 2 drugs must be kept in approved safe custody — in practice, a CD cabinet or safe meeting the required standard. Size it realistically. CBPM flower is bulky compared with conventional Schedule 2 stock, and undersized custody is a genuinely common planning error in this category.

The CD register. Record every receipt and supply, maintain and reconcile running balances, and keep entries for two years from the last entry. Investigate and document discrepancies rather than quietly correcting them. At volume this is significant daily work, and precisely where software support matters. A controlled drugs register module is on Dataforge PMR's roadmap for release at the end of 2026. Until then, register discipline is a process the pharmacy runs alongside its PMR — which is exactly how it should be evidenced to an inspector.

Private CD prescriptions. CBPM prescriptions arrive privately, which brings the private controlled drug prescription requirements. That means the standardised private CD prescription form, the prescriber's private CD prescriber identification, submission of the prescription to the relevant NHS agency after dispensing, and retention of the pharmacy's records. Build the prescription-validity check as a hard gate in the workflow. A Schedule 2 prescription that fails on form is not a prescription.

Destruction and returns. Patient returns and expired stock need documented destruction arrangements, with authorised-witness requirements for stock destruction. In a category with this much scrutiny, the destruction log is not the record to improvise.

The full record-keeping picture, including where the CD rules and the specials rules overlap and double up, is unpacked in dispensing cannabis-based medicinal products: the rules explained properly.

How does the specials regime change dispensing?

It attaches supply conditions and a second record-keeping layer to every item. An unlicensed medicine may only be supplied to meet the special clinical need of an individual patient, ordered by an authorised prescriber. The supplier must hold the records that prove it. The Medicines and Healthcare products Regulatory Agency (MHRA) guidance on specials sets the frame: supply against bona fide unsolicited orders, verify that the prescriber and the special-need basis exist, and keep transaction records for five years.

Operationally, three consequences matter. First, the paper trail per item is doubled. The CD register satisfies the Misuse of Drugs Regulations; the specials records satisfy the MHRA regime. They are different records answering different questions. Second, batch-level traceability is not optional housekeeping in this category. Know what batch went to which patient, because recalls in an import-dependent unlicensed supply chain are a when, not an if. Third, the promotional boundary is structural. Unlicensed medicines cannot be advertised, and prescription-only medicines cannot be promoted to the public. Together those rules mean the pharmacy's website presents the service and the pathway, never the products — however much patients search for product names.

How do prescriptions and clinics fit together?

Prescriptions reach the pharmacy from CQC-regulated clinics whose specialist doctors initiate treatment. That makes clinic relationships the commercial engine, and prescriber verification the compliance gate on that engine. A CBPM pharmacy without clinic relationships is a compliance exercise with no revenue. So treat clinic partnerships as seriously as the GPhC application: who prescribes for you, on what terms, with what volumes. Agree service-level expectations on the prescription-to-delivery interval too — in this market it is a competitive metric as much as a governance one.

Verification then has to be genuinely robust, not performative. Confirm the prescriber against the GMC register, including specialist registration. Establish the clinic's provenance. Check the private CD prescription against the form requirements. Record the whole check, so the pharmacy can evidence months later why it was satisfied. The workflow that carries all of this from received prescription to signed-for delivery — including identity checks and failed-delivery handling for a Schedule 2 parcel — is the subject of building a compliant CBPM dispensing workflow. The structural question of whether the clinic and the pharmacy should sit under one roof is covered in the clinic-plus-pharmacy model; integrated operators increasingly answer yes.

Where do new entrants get hurt?

They get hurt in five predictable places, and every one is cheaper to prevent than to repair.

Underestimating the record-keeping load. The CD register plus specials records plus private prescription submission is a daily operational cost, not an inspection-week scramble. Staffing plans that ignore it produce the backlogs that become findings.

Supply chain naivety. Import lead times, product discontinuations and importer stock allocation are normal in this category. Promise clinic partners delivery intervals the supply chain cannot support, and you burn the relationships that feed you.

Security under-specification. A pharmacy whose entire stock is Schedule 2 is a different security proposition from a conventional pharmacy — for insurers and inspectors alike. Build the specification, monitoring and evidence to that reality before anyone asks.

Presentation drift. Website product names and imagery that slide from clinical towards adult-use are a regulatory exposure, given the sector-wide branding concern regulators have already signalled. They are also an advertising-rules breach waiting to happen.

Treating the regulator as a consultant. The GPhC will not tell you how to run a CBPM pharmacy. The superintendent must be able to justify why every SOP is best practice for this model, considering everything, and defend it. It is the same discipline described in the GPhC premises application, applied to the hardest category in the sector.

Key takeaways

FAQs