What do GPhC inspectors look for in 2026?

How do GPhC inspections work in 2026?

The General Pharmaceutical Council (GPhC) inspects registered pharmacies through three routes: routine, intelligence-led and themed. Intelligence-led inspections are triggered by concerns, reports or data. Themed reviews examine specific areas of practice across many pharmacies. Since January 2025, routine inspection has run on a two-format model. Full inspections cover all the standards. Shorter focused inspections concentrate on a core set of standards — the ones most frequently unmet and most critical to patient safety. Inspectors can switch a focused inspection to a full one on the day if what they find warrants it. And a pharmacy being inspected for the first time automatically receives a full inspection, which matters for every new registration and every newly acquired premises.

Two features of the model shape everything else in this guide. First, inspections are unannounced as a general rule. In the GPhC's own words, that is so outcomes reflect whether the pharmacy is meeting the standards every day rather than on a prepared day. Second, the volume is real. The inspections website was showing 149 reports published in a single recent 28-day window. The regulator publishes quarterly insights on the patterns it finds. It now also runs regulatory engagement meetings: structured conversations with organisations whose inspection outcomes or concern volumes fall below expectations. The practical conclusion arrives before the detail does. You cannot cram for a GPhC inspection. There is only how the pharmacy runs, and the rest of this article is about making how it runs inspectable.

What changed in the January 2026 decision making framework

On 13 January 2026 the GPhC published an updated inspection decision making framework — the operational document inspectors use to reach consistent judgements. It is the closest thing to a published answer sheet the sector has ever had. The framework sets out the factors inspectors weigh and gives structured examples across four categories. They are: findings likely to mean a standard is met, findings likely to fail one, areas for improvement (a standard met but weaknesses identified) and good practice. It consolidates and replaces the previous findings framework and the practice note on minor non-compliance, both now withdrawn. The regulator is explicit that it is a guide for professional judgement, not a checklist, and that impact and scale are considered in every judgement.

The 2026 additions tell you where attention has moved. Distance supply gets enhanced guidance, reinforcing that remote models must offer safeguards equivalent to physical ones. The emphasis falls on clinical oversight, identity verification and patient engagement. Website transparency expectations are spelled out: name the prescriber, give the prescribing service's address and say whether the prescriber is a doctor or a non-medical prescriber. The framework is also explicit that failing to independently verify a patient's weight, height or body mass index when supplying weight management medication will fail the standard. And it aligns inspection expectations with the revised supervision legislation. Inspectors are directed to assess how pharmacies operate the new supervision and delegation arrangements, alongside new material on hub-and-spoke models and prescribing.

What outcome can you get, and what happens next?

An inspection produces one of two overall outcomes: standards met, or standards not all met. The arithmetic is unforgiving. Every standard inspected must be met, so a single failed standard fails the whole inspection. Beneath the overall outcome, each of the five principles receives one of four findings: standards not all met, standards met, good practice or excellent practice. Individual standards can also carry an area-for-improvement flag even where met. The GPhC publishes reports on its inspections website, along with any improvement action plan and any enforcement action. Previous reports remain visible as inspection history. Owners can correct factual inaccuracies in draft reports and request a review of an adverse overall judgement. But publication itself is not optional, which makes an inspection outcome a public reputational event as well as a regulatory one.

A standards-not-all-met outcome triggers the improvement action plan process, and the GPhC publishes its mechanics. The pharmacy is expected to tell the regulator within five working days what action it intends to take. The inspector will have set a completion window of 10, 20 or 60 working days for each failed standard. The owner and superintendent pharmacist must complete and return the plan together, and it is published alongside the report. Once the pharmacy notifies completion and the inspector is satisfied with the evidence, a re-inspection follows. It can be on site or desktop, and is scheduled up to six months from the final report to confirm improvements are sustained. An updated report showing standards met is then published. Where owners do not engage, or risks are serious, the enforcement ladder from our enforcement analysis applies. That means improvement notices, conditions on the premises and, in the gravest cases, suspension or removal from the register.

Where pharmacies actually fail

The failure data is concentrated, published and stable. That makes it the most useful targeting information an owner has. The GPhC's April 2026 review of weight management services broke down the standards recorded as not met or requiring improvement. 46% fell under standard 1.1, risks identified and managed; 28% under 4.2, services managed and delivered safely and effectively; and 15% under 1.6, records maintained. The regulator's longer-run learning-from-inspections analysis points the same way. Principle 1, governance, is consistently the strongest driver of both good and poor overall performance, followed by principle 4. And the online multiplier is documented: 37% of distance and online pharmacy inspection reports published in 2025 did not meet all standards, against 12% for community pharmacies.

The regulator's own examples show what those failures looked like in practice. Risk assessments were absent, partial or unreviewed. There was no working process for independently verifying what patients declared. Third-party prescribing arrangements ran without evidenced assurance. Staff did not follow the pharmacy's own procedures on clinical checks. Consultation records were too thin to demonstrate that a safe, clinically appropriate decision was made. None of it is exotic. All of it is governance, service delivery and records, which is why the self-audit in this guide concentrates there. There is encouragement in the data too. Pharmacies inspected more than once improve more often than they deteriorate. And the GPhC's analysis found every pharmacy rated excellent was a community pharmacy, most of them independents, so the ceiling is not reserved for chains.

What inspectors ask for, record by record

The GPhC describes its approach as show and tell. Inspectors look at the services actually being provided, involve the whole team and sample real records. For any sampled patient journey, expect to produce the following. The risk assessment for the service, in force and with a review date. Identity evidence on that patient's record, plus independent verification where the medicine's category demands it. The prescriber's identity, decision and rationale for that supply, including for repeats and dose changes. A consultation record that demonstrates the clinical decision on its own. The dispensing and accuracy checks, with named staff. The delivery trail for distance supplies. And, where a third party prescribed, the due diligence file and service-level agreement behind the arrangement, as the distance services guidance requires.

Around the sampled journeys sit the standing evidence sets. These are the SOP suite with owners and review dates, and the competence matrix linking every task to signed-off staff. Add training and enrolment records, the responsible pharmacist record, and complaints and incident logs with the learning they generated. For online operations, add the website itself: inspectors often review it before arriving, and now assess it against the framework's transparency expectations. We have been through inspections and built systems for them, and the pharmacies that find inspections uneventful share one property. Every item above exists because the work generated it, attributed to a named person at the time it happened. Producing it is retrieval rather than reconstruction.

The daily-running method: preparation that isn't preparation

Unannounced inspection makes readiness an operating property. The method is a set of rhythms rather than a sprint.

Monthly, the compliance calendar's claims and records rhythm doubles as evidence hygiene. And treat the governance file as part of every change event — a new service, a new location, a staffing change, a regulation update — not an afterthought. The framework's examples repeatedly describe services that outran their documentation.

Assign each evidence area one named owner. The GPhC's own performance analysis ties good outcomes to governance, systems and culture rather than paperwork volume, and shared obligations are the ones that lapse. Be honest about tooling too. A records infrastructure that generates the audit trail as the work happens is the difference between retrieval and reconstruction. This is the standard Dataforge PMR was built to, and it has been tested where it counts. Pharmacies running their private operations on Dataforge PMR have been through GPhC inspection and met the standards. New pharmacies have opened and launched their private services on the platform from day one. That is exactly the first-inspection scenario, where a full inspection is guaranteed and the evidence file has no history to lean on.

If the inspection goes badly

A standards-not-all-met outcome is recoverable. But the recovery is itself inspected, so the discipline matters. Respond inside the five working days with intended actions that address root causes rather than restating the findings. If the failed standard is 1.6, the fix is a records system and the habit that maintains it, not a retrospectively completed folder. Hit the 10, 20 or 60 working-day windows the inspector set, prioritising anything touching patient safety immediately. Notify completion with evidence, because the re-inspection within six months tests whether improvements are sustained, not whether they briefly existed. Both owner and superintendent sign the plan, reflecting the joint responsibility the February 2025 guidance established. And both should treat the published plan as what it is: a public document your patients, your competitors and any prospective buyer of your pharmacy can read. Handled well, the record then shows what the GPhC's own data says is the norm — an improved rating next time. Handled defensively, it is the first exhibit in an enforcement file.

The 2026 inspection readiness checklist

Key takeaways

FAQs