How to set up a medicinal cannabis dispensing pharmacy in the UK

What are you actually building?

You are building a registered pharmacy whose entire catalogue is unlicensed Schedule 2 controlled drugs prescribed by specialists and delivered to patients who never visit. Each element of that sentence carries a regulatory regime, and the pharmacy is where they stack. It is written for the market described in our 2026 market analysis, where the pharmacy layer is both the sector's bottleneck and its moat.

Cannabis-based products for medicinal use (CBPMs) sit in Schedule 2 of the Misuse of Drugs Regulations 2001, so everything the pharmacy holds is subject to controlled drug requirements including safe custody and register-keeping. Almost all CBPMs are unlicensed, so supply runs under the specials regime with its own record-keeping and supply-condition obligations. Prescriptions originate only from doctors on the General Medical Council (GMC) Specialist Register, arriving as private prescriptions from Care Quality Commission (CQC) regulated clinics, so prescriber verification is a core workflow rather than an edge case. And the patient base is remote, which makes this a distance selling model under the General Pharmaceutical Council (GPhC) distance services guidance, with the added twist that what is being shipped is a Schedule 2 drug.

None of that changes the legal foundation. A CBPM pharmacy is a registered pharmacy under the Medicines Act 1968 like any other: the ownership rules, the superintendent requirement and the premises registration are exactly those covered in structuring a pharmacy business and the GPhC premises application.

What does the setup sequence look like?

The sequence is the standard distance selling launch with CD and specials infrastructure built in from the start rather than retrofitted, and the honest planning assumption is that the specialist layers add cost and evidence weight rather than new regulatory gates.

Two sequencing points from experience with regulated launches. First, specify the CD cabinet and the alarm system before the GPhC evidence pack is assembled, because security is the classic further-information trigger and it bites harder when the application says "medicinal cannabis" on it. Second, open the supply-chain conversations before the premises is finished: importer onboarding, credit terms and product availability move on their own clock.

The general costs and working capital logic in what it really costs to launch an online pharmacy applies with a heavier stock line, since CBPM stockholding is expensive per item and hostage to import lead times.

What does the controlled drugs infrastructure actually require?

It requires safe custody, registers, compliant prescriptions and disciplined destruction, all evidenced continuously rather than assembled for inspection. This is the daily texture of the business, so build it as workflow, not as paperwork.

Safe custody. Schedule 2 drugs must be kept in approved safe custody, which in practice means a CD cabinet or safe meeting the required standard, sized realistically: CBPM flower is bulky relative to conventional Schedule 2 stock, and undersized custody is a genuinely common planning error in this category.

The CD register. Every receipt and supply recorded, running balances maintained and reconciled, entries retained for two years from the last entry, and discrepancies investigated and documented rather than quietly corrected. At volume this is significant daily work, and it is precisely the area where software support matters; a controlled drugs register module is on Dataforge PMR's roadmap for release at the end of 2026, and until then the register discipline is process the pharmacy runs alongside its PMR, which is exactly how it should be evidenced to an inspector.

Private CD prescriptions. CBPM prescriptions arrive privately, which brings the private controlled drug prescription requirements: the standardised private CD prescription form, the prescriber's private CD prescriber identification, submission of the prescription to the relevant NHS agency after dispensing and retention of the pharmacy's records. Build the prescription-validity check as a hard gate in the workflow, because a Schedule 2 prescription that fails on form is not a prescription.

Destruction and returns. Patient returns and expired stock need documented destruction arrangements, with authorised-witness requirements for stock destruction, and in a category with this much scrutiny the destruction log is not the record to improvise.

The full record-keeping picture, including where the CD rules and the specials rules overlap and double up, is unpacked in dispensing cannabis-based medicinal products: the rules explained properly.

How does the specials regime change dispensing?

It changes dispensing by attaching supply conditions and a second record-keeping layer to every item, because an unlicensed medicine may only be supplied to meet the special clinical need of an individual patient, ordered by an authorised prescriber, and the supplier must hold the records that prove it. The Medicines and Healthcare products Regulatory Agency (MHRA) guidance on specials sets the frame: supply against bona fide unsolicited orders, verification that the prescriber and the special-need basis exist, and transaction records retained for five years.

Operationally, three consequences matter. First, the paper trail per item is doubled: the CD register satisfies the Misuse of Drugs Regulations while the specials records satisfy the MHRA regime, and they are different records answering different questions. Second, batch-level traceability is not optional housekeeping in this category; know what batch went to which patient, because recalls in an import-dependent unlicensed supply chain are a when, not an if. Third, the promotional boundary is structural: unlicensed medicines cannot be advertised, prescription-only medicines cannot be promoted to the public, and both rules together mean the pharmacy's website presents the service and the pathway, never the products, however much patients search for product names.

How do prescriptions and clinics fit together?

Prescriptions reach the pharmacy from CQC-regulated clinics whose specialist doctors initiate treatment, which makes clinic relationships the commercial engine and prescriber verification the compliance gate on that engine. A CBPM pharmacy without clinic relationships is a compliance exercise with no revenue, so the market entry plan should treat clinic partnerships with the same seriousness as the GPhC application: who prescribes for you, on what terms, with what volumes and what service-level expectations on the prescription-to-delivery interval, which in this market is a competitive metric as much as a governance one.

Verification then has to be genuinely robust rather than performative: the prescriber confirmed against the GMC register including specialist registration, the clinic's provenance established, the private CD prescription checked against the form requirements, and the whole check recorded so that the pharmacy can evidence, months later, why it was satisfied. The workflow that carries all of this from received prescription to signed-for delivery, including identity checks and failed-delivery handling for a Schedule 2 parcel, is the subject of building a compliant CBPM dispensing workflow, and the structural question of whether the clinic and the pharmacy should sit under one roof is covered in the clinic-plus-pharmacy model, because integrated operators increasingly answer yes.

Where do new entrants get hurt?

They get hurt in five predictable places, and every one is cheaper to prevent than to repair.

Underestimating the record-keeping load. The CD register plus specials records plus private prescription submission is a daily operational cost, not an inspection-week scramble, and staffing plans that ignore it produce the backlogs that become findings.

Supply chain naivety. Import lead times, product discontinuations and importer stock allocation are normal in this category; pharmacies that promise clinic partners delivery intervals the supply chain cannot support burn the relationships that feed them.

Security under-specification. A pharmacy whose entire stock is Schedule 2 is a different security proposition from a conventional pharmacy, for insurers and inspectors alike, and the specification, monitoring and evidence should be built to that reality before anyone asks.

Presentation drift. Product names and imagery on the website sliding from clinical towards adult-use is both a regulatory exposure, given the sector-wide branding concern regulators have already signalled, and an advertising-rules breach waiting to happen.

Treating the regulator as a consultant. The GPhC will not tell you how to run a CBPM pharmacy; the superintendent must be able to justify why every SOP is best practice for this model, considering everything, and defend it, which is the same discipline described in the GPhC premises application applied to the hardest category in the sector.

Key takeaways

FAQs