Business case and benefits
- Supply director
- A · Accountable
- Product owner
- R · Responsible
- Solutions architect
- C · Consulted
- Technical PM
- C · Consulted
- Engineers
- I · Informed
- Responsible Person
- I · Informed
- Security
- I · Informed
Shortages seen weeks earlier, scarce stock shared fairly under manufacturer quotas, and pharmacies told honestly what they'll get and when. People set the rules and approve every allocation.
At a glance
An illustrative scenario. Linked to a real, anonymised case study below; the numbers here are still typical examples. The cloud services and UK rules were checked on 9 November 2026.
A full-line wholesaler buys from hundreds of manufacturers and delivers to community pharmacies, dispensing doctors and hospitals, often twice a day. When a product starts to run short, the early signs are scattered: a manufacturer's delivery slips, a quota letter arrives by email, a Medicine Supply Notification is published, a price concession is granted, or orders for a different strength suddenly jump. Buyers piece these together by hand, usually after the stock has gone.
Once a manufacturer puts a product on quota, the wholesaler has a fixed monthly allocation to share across thousands of customers. In many businesses that means a spreadsheet of caps per account, set from old history and adjusted by hand. Early orderers get stock and late ones get "out of stock" with no date. Customer services spend hours on calls they can't answer well, and pharmacies order the same line from several wholesalers to be safe, which makes the demand signal noisier still.
The pressure is real. DHSC granted 245 price concessions for October 2026, each one a product pharmacies couldn't buy at the Drug Tariff price. DHSC's best practice guidance, revised in August 2026, asks wholesalers to manage quota allocations fairly, with a clear review process, to avoid gaps between regions, and not to hoard. Any new way of sharing stock has to be explainable to the Responsible Person, to customers and, if asked, to DHSC.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
How many days before a stock-out the product first appeared on the watch list.
ExampleFour weeks or more for most shortages
Forecast error by product and depot, reported separately for lines on quota, where it matters most.
ExampleBetter than today's baseline, every month
The share of normal need each customer group received while a product was on quota, by region and customer type.
ExampleNo region or customer type consistently worse off
Lines that ran out without any warning.
ExampleDown by a third in the first year
Calls and emails to customer services about availability.
ExampleDown by half
How often supply managers change the proposed allocation. Very high means it isn't helping; near zero can mean nobody is checking.
ExampleStable, and reviewed weekly
Cross-sector rules are on the UK regulation map.
The Human Medicines Regulations 2012 (regulation 43(2)) require the licence holder to ensure appropriate and continued supplies so patients' needs are met, and DHSC has said hoarding can breach this. Allocation rules share stock across all customers, keep a reserve for urgent need, and never hold stock back for margin.
Every alternative offered must be a licensed product from a qualified supplier, delivered to a customer qualified to receive it. The Responsible Person signs off the substitution rules, and changes go through change control. Controlled drugs stay within the existing Home Office-licensed processes and records.
Wholesalers should manage quotas fairly with a clear review process, avoid regional gaps, share demand changes with manufacturers within competition rules, and report suspected hoarding. Each of these is a feature of the design, not an afterthought.
Wholesalers must answer DHSC requests for sales and volume data promptly. A clean data platform turns each request into a report, not a project.
Medicines for Northern Ireland are now licensed UK-wide in 'UK Only' packs, so one stock pool can usually serve the whole UK. Older in-date packs licensed for Great Britain or Northern Ireland only are tagged, so an allocation never sends them to the wrong place.
This is mostly business data, but customer records name pharmacists and some dispensing doctors trade as individuals. No patient data is needed. A short DPIA, UK regions, and a contract that stops providers training their models on your data.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Signals
02Intake
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Signals in: supplier emails, notices, ordersSupply notices and SSPs are published for people, not machines. Expect to read web pages and PDFs, and keep a person checking the link to your product codes. | Amazon SES, S3, API Gateway | Logic Apps connectors, Blob Storage, API Management | Your mail server, Ceph or IONOS S3 Object Storage, Kong or your existing API gateway |
| Reading quota letters and noticesA buyer confirms every extracted quota before it drives an allocation. | Amazon Bedrock, with Textract for scanned letters | Microsoft Foundry, with Azure Content Understanding | Open-source parsing (e.g. Docling) plus an open-weight model served with vLLM, or IONOS AI Model Hub |
| Data platformMap every pack to its NHS dictionary of medicines and devices (dm+d) code, so alternatives and duplicates can be found. | Amazon S3, AWS Glue, Amazon Redshift | Microsoft Fabric (OneLake, Data Factory) | PostgreSQL, or an open lakehouse (e.g. Apache Iceberg with Trino) on Ceph |
| Forecasting and shortage riskAmazon Forecast closed to new customers in July 2024. Don't start new work on it. | Amazon SageMaker AI (Canvas first, custom models later) | Azure Machine Learning | MLflow and Kubeflow on Kubernetes |
| Agent runtimeThe original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore. | Amazon Bedrock AgentCore | Foundry Agent Service | An open-source agent framework (e.g. LangGraph) on Kubernetes |
| Allocation engineDeliberately not an AI model: plain, tested rules the business can read and the Responsible Person can sign off. | AWS Lambda or Amazon ECS | Azure Functions or Container Apps | Kubernetes on-prem (e.g. OpenShift, Rancher), or IONOS Managed Kubernetes |
| Workflow | AWS Step Functions | Logic Apps or Durable Functions | Temporal, or n8n |
| Middleware and events | Amazon EventBridge, SQS | Event Grid, Service Bus | Apache Kafka or RabbitMQ |
| Link to ERP and warehouseThe ERP keeps enforcing quotas at order entry, as it does today. The AI only proposes the numbers. | API Gateway, plus your existing integration platform | API Management, plus your existing integration platform | Kong, or your existing API gateway, plus your existing integration platform |
| Human reviewPeople approve allocations where they already work, not in a new tool. | In the buyers' existing ERP screens | In the buyers' existing ERP screens | In the buyers' existing ERP screens |
| Guardrails | Bedrock Guardrails | Foundry guardrails (Azure AI Content Safety) | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Identity, keys, data protection | IAM Identity Center, KMS | Entra ID, Key Vault, Purview | Keycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditCheck forecast drift with your own scheduled tests. SageMaker Model Monitor closed to new customers on 30 July 2026. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residency | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK/EU provider (IONOS AI Model Hub runs in Germany) |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
The ERP, warehouse system and customer ordering portal stay where they are, and so does the allocation engine, which sits next to the ERP's quota tables. Named customer accounts and their order history don't need to leave your data centre.
Uses cloud AI
Forecast training, the shortage watch list and the agent that reads quota letters and public notices run in the cloud, where models and compute are easy to scale. They receive demand and stock by product, depot and customer group, not named accounts.
How they connect
A private link, AWS Direct Connect or Azure ExpressRoute, carries nightly extracts and change events out, and allocation proposals back through your API gateway, which is the only way in to the ERP. If you'd rather run the cloud services on your own hardware, AWS Outposts or Azure Local with Azure Arc are options.
If the link drops
Ordering and quota enforcement carry on, because they live in the ERP. The last approved allocations stay in force, forecasts are marked as stale, and buyers work from the weekly review until the link returns and queued events catch up in order.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
Supply analyst agent
Where a person signs offA supply manager approves every allocation before it goes live, and the Responsible Person signs off the allocation and substitution rules themselves. Customer messages follow templates a person has approved. The agent's permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.
The ERP stays the system of record for stock, quotas and orders, and keeps enforcing quota caps at order entry. The AI never writes to it directly. Approved allocations go through the API layer and your existing integration platform, like any other change.
Every goods receipt, order, quota change and published notice becomes an event, so forecasts and the watch list update without polling the ERP. If the forecasting service is down, the last approved allocation stays in force and ordering carries on as normal.
Outside signals are fragile: web pages change and supplier emails vary. Each feed has a health check, and a missing feed shows as missing on the dashboard rather than quietly reading as "no shortage".
DHSC encourages sharing demand changes with manufacturers, within competition rules. Agree with your legal team what leaves the business, and at what level of detail, before building any feed to a supplier.
Map how shortages and quotas are handled today, measure stock-outs and availability calls, check product data and dm+d mapping, and draft the allocation policy.
Gate · must be true to passBaseline agreed, data access confirmed, allocation policy drafted with the Responsible Person and commercial, and legal's view on data sharing.
Forecasts and the watch list run in shadow mode across all lines, back-tested on last year's shortages. Allocation proposals run alongside today's spreadsheet for a handful of quota lines.
Gate · must be true to passThe watch list caught most past shortages early, proposals are at least as fair as today's, and buyers and the Responsible Person sign off.
Approved allocations go live for quota lines, and expected dates appear in the ordering portal, with monitoring, support and a rollback plan.
Gate · must be true to passMonitoring, support model, rollback plan and customer services training in place.
Add hospital contracts, share agreed forecasts with manufacturers, then reuse the pattern for short-dated and slow-moving stock.
Gate · must be true to passEach extension passes the same pilot gate.
| Activity | Supply director | Product owner | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | Responsible Person | SecurityI can fill this |
|---|---|---|---|---|---|---|---|
| Business case and benefits | Accountable | Responsible | Consulted | Consulted | Informed | Informed | Informed |
| Allocation policy: what "fair" means | Accountable | Responsible | Consulted | Informed | Informed | Consulted | Informed |
| Target architecture | Informed | Consulted | Accountable and Responsible | Consulted | Consulted | Consulted | Consulted |
| Substitution rules and change control | Informed | Consulted | Consulted | Informed | Informed | Accountable and Responsible | Informed |
| Build and integration with ERP and warehouse | Informed | Consulted | Accountable | Responsible | Responsible | Informed | Consulted |
| Back-testing on past shortages | Informed | Accountable | Responsible | Consulted | Responsible | Consulted | Informed |
| Go-live decision | Accountable | Responsible | Consulted | Responsible | Informed | Consulted | Consulted |
| Run, monitor and improve | Informed | Accountable | Consulted | Consulted | Responsible | Consulted | Consulted |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the data platform, the forecasting and allocation services, and the integration with your ERP and warehouse system. Having built an ERP for a medical supplier, I'd start where these projects usually stall: product data and the quota rules already in your ERP. I'd report to your programme board.
Option B
If your partner or your own team already has an architect, I'd take on the forecasting models, the agent and the ERP integration under their lead, and give them a second senior opinion on the rest. They stay in charge of the design; I make the hard parts lighter.
Goes wrong
The model learns from orders, but a shortage changes the orders: pharmacies over-order, switch strengths and order from three wholesalers at once.
How the design avoids it
Forecast normal need from steady order history, treat SSPs and quota changes as known events, and never allocate on the latest order alone.
Goes wrong
Allocation becomes a black box, and customers who lose out can't be told why.
How the design avoids it
Allocation is plain, tested rules, not a model. The AI supplies the inputs; the rules are written down, signed off and explainable to any customer.
Goes wrong
The same medicine sits under five product codes, so alternatives and duplicates are missed.
How the design avoids it
Map every pack to dm+d during discovery, with a named owner, before trusting any forecast.
Goes wrong
Expected dates shown to pharmacies turn out wrong, and trust goes.
How the design avoids it
Show a date only with how sure it is, say "not known" when it isn't, and measure how often the dates were right.
Goes wrong
The watch list cries wolf, so buyers stop reading it.
How the design avoids it
Back-test on last year's shortages, keep the list to what buyers can act on, and track which warnings proved right.
Changes already announced or under way that affect this design. More in the UK horizon scan.
DHSC consulted from February to May 2026 on wider reporting of supply problems, requests for stock and future delivery data when demand may outstrip supply, penalties without a prior compliance notice, and giving hub-and-spoke dispensing hubs the same reporting duties as wholesalers. Keep stock, delivery and sales history in a form you could hand over within days.
DHSC consulted on letting pharmacists supply a different strength or formulation in some cases. The consultation closed in December 2025, and in October 2026 DHSC said it would set out next steps within weeks. If it goes ahead, demand will move between strengths and forms faster than today. Group products by medicine, not only by pack, so the forecast can follow.
NHS England, the MHRA and Medicines UK launched a 12-month pilot in February 2026 to bring dormant licences for 378 at-risk medicines back to market, with a longer-term programme planned for 2027. New suppliers for old products will appear. Make adding a supplier and its quota a configuration change, not a code change.
DHSC and NHS England plan to show shortage information to prescribers, with an information standard in development. Keep your availability data structured, dated and easy to share, so you're ready if it's asked for.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.