Each branch knows tomorrow's workload today. Repeat items go to the hub when it makes sense, owings are chased before patients ask, and pharmacists get time back for clinical services.
At a glance
An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.
Prescriptions arrive at each branch through the Electronic Prescription Service. Repeat items come in steady waves, but nobody can say with confidence how many will land at a given branch next Tuesday, so rotas are set by habit and the dispensary is either idle or overrun. When it's overrun, the pharmacist ends up assembling and checking instead of running the consultations the branch is now paid for.
Most groups already run a central hub, or are building one. The hard part isn't the robot. It's deciding, item by item, what can go to the hub and come back in time: the prescription has to arrive early enough, the item has to suit the hub, and the patient must not be left waiting. Today that decision is often a blunt rule, such as every repeat for certain branches, so the hub runs below capacity while branches stay busy.
Shortages make everything harder. Owings are tracked on paper or in the dispensing system, and staff spend hours a day ringing wholesalers. Industry surveys in 2026 reported most pharmacies spending more time sourcing medicines than a year before. Meanwhile, independent prescribing is being added to Pharmacy First, which asks for even more pharmacist time.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
How close the daily item forecast is for each branch. Measured per branch, not averaged across the group, where errors cancel out.
ExampleWithin 10% on most branch days
The share of suitable items that actually go through the hub and come back on time.
ExampleUp from a blunt rule to what the hub can really handle
Prescriptions waiting when the patient comes in, including hub items.
ExampleNo worse than today, then better
How long patients wait for items owed, and how many owings pass seven days.
ExampleDown by a third
Consultation hours per pharmacist, from the rota and the clinical system.
ExampleMeasured against last year
Near misses and errors, at branch and hub, shared both ways. This must not rise.
ExampleFlat or falling, reviewed weekly
Cross-sector rules are on the UK regulation map.
Since 1 October 2025, hub and spoke can work between different legal entities, using the patient, spoke, hub, spoke, patient model only. The label carries the spoke's name and address and the date the hub assembled the item. Schedule 1 to 3 controlled drugs can't go through a hub run by a different legal entity. These exclusions are hard rules in the routing engine, not something a model learns.
A spoke must tell its ICB about each cross-entity arrangement, normally 28 days before it starts, now through the NHSBSA Manage Your Service portal. It must also tell patients the arrangement exists. The design keeps a live register of which branch uses which hub, and which items went where.
Both hub and spoke are registered pharmacies and each needs a responsible pharmacist. The GPhC's October 2025 review of hub and spoke found errors weren't always shared between sites, and many spokes weren't telling people about the arrangement. A shared incident log and patient notices are part of the build, not an afterthought.
Since 7 January 2026, a pharmacist can authorise team members to hand out checked and bagged prescriptions. From 10 December 2026, pharmacists can authorise pharmacy technicians to supervise assembly and dispensing. The AI takes no part in any check, and task permissions follow who is authorised, not job titles.
For NHS prescriptions in England, the supervising pharmacist may adjust quantity by up to 10% to supply whole packs, since 1 January 2025. It's a professional judgement, not a default. The system can show where it would apply, but any change made at the hub is flagged for the spoke pharmacist, who makes the final supply decision.
Prescriptions are health data. That means a DPIA, forecasting on pseudonymised data, processing in UK regions, and a contract that stops providers training models on your data. Every branch completes the Data Security and Protection Toolkit each year, and the new platform has to fit inside that assurance.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Channels
02Intake
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Intake: dispensing events, wholesaler feedsThe cloud never connects to the NHS Spine. It receives events from your dispensing system, through whatever interface your supplier provides. | API Gateway, AWS Transfer Family, S3 | API Management, Logic Apps connectors, Data Lake Storage | Kong or your API gateway, an SFTP or EDI gateway, Ceph |
| Analytics storeHolds pseudonymised item history, branch calendars, hub capacity and van schedules. | Amazon Redshift | Microsoft Fabric | PostgreSQL, or your existing data warehouse |
| ForecastingAmazon Forecast is closed to new customers, so new builds use SageMaker AI. Start with a simple seasonal model per branch, and only add complexity that beats it. | Amazon SageMaker AI | Azure Machine Learning | MLflow and Kubeflow on Kubernetes |
| Reasoning and summariesBoth offer a choice of models, including Claude and others. | Amazon Bedrock | Microsoft Foundry | Open-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub |
| SOPs and supply knowledge (retrieval)Your SOPs, hub eligibility rules, Medicine Supply Notifications and serious shortage protocols, so answers cite the source. | Bedrock Knowledge Bases | Foundry IQ, built on Azure AI Search | OpenSearch, or PostgreSQL with pgvector |
| Agent runtimeThe original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore. | Amazon Bedrock AgentCore | Foundry Agent Service | An open-source agent framework (e.g. LangGraph) on Kubernetes |
| Routing workflowEligibility rules run first and can't be overridden by a model. The forecast only chooses between options the rules allow. | AWS Step Functions | Logic Apps or Durable Functions | Temporal, or n8n |
| Middleware and events | Amazon EventBridge, SQS | Event Grid, Service Bus | Apache Kafka or RabbitMQ |
| Human reviewIf the supplier can't take tasks, one simple branch screen, not a new app per job. | In the dispensing system's task list where the supplier allows it | In the dispensing system's task list where the supplier allows it | In the dispensing system's task list where the supplier allows it |
| Guardrails | Bedrock Guardrails | Azure AI Content Safety | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Identity, keys, data protection | IAM Identity Center, KMS, Macie | Entra ID, Key Vault, Purview | Keycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditLog every routing decision and every owing action, with the reason, against the item. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residency | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK/EU provider (IONOS AI Model Hub runs in Germany) |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
The dispensing system (PMR), the hub automation system and every patient-identifiable prescription stay where they run today, in your data centre or your supplier's hosting. Item history is pseudonymised before anything leaves.
Uses cloud AI
Forecasting on pseudonymised item history, retrieval over SOPs and supply notices, and the owings agent's reasoning. None of it needs a patient's name to work.
How they connect
A private link from your data centre to the cloud, such as AWS Direct Connect or Azure ExpressRoute, or a site-to-site VPN for the pilot. Events flow out through the queue and tasks flow back. On the sovereign option, the same parts run on Kubernetes in your own data centre or with a UK or European provider.
If the link drops
Dispensing carries on, because nothing clinical depends on the link. Routing falls back to the fixed hub rules held on-prem, owings go back to the branch list, and queued events catch up when the link returns, each with an ID so nothing is processed twice.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
Owings and shortages agent
Where a person signs offA pharmacist decides every alternative, every use of a shortage protocol and every conversation with a prescriber. The branch team decides what to tell the patient. The agent's limits are enforced by the platform's identity and policy controls, not by instructions in a prompt.
The dispensing system (PMR) is the system of record for every prescription, and the integration with it decides the whole project. Some suppliers offer APIs or event feeds; others offer a nightly extract. Find out which in discovery, because the forecast can run on a nightly extract, but owings work needs data within the hour.
Events decouple the AI from the dispensary. Each new prescription, hub dispatch and owing becomes a message on a queue. If the hub's system is slow or a link drops, messages wait safely, and every message carries an ID so nothing is routed twice. The NHS's move from the HL7 v3 interface to FHIR APIs for EPS will change what suppliers send, so the design reads your supplier's interface, not the raw NHS message format.
The AI can be switched off without stopping dispensing. If it's paused, routing falls back to today's fixed rules and owings go back to the branch list. Prescriptions keep flowing because nothing clinical depends on it.
Map prescription flow at a sample of branches and the hub, measure the baseline, and confirm what data the dispensing system supplier can provide, and how fast.
Gate · must be true to passData access confirmed in writing, baseline agreed, DPIA started, and the superintendent's office involved.
Forecasts and routing recommendations for 20–30 branches in shadow mode, and the owings agent live in ten branches with a pharmacist reviewing every action.
Gate · must be true to passForecast accuracy within agreed limits, no rise in incidents, branch teams find owings tasks useful, and superintendent sign-off.
Routing goes live for the pilot branches, with monitoring, support, the fallback to fixed rules, and a rollback plan.
Gate · must be true to passMonitoring, support model, fallback tested, and training in place at branch and hub.
Add branches in waves, by hub and region, then reuse the forecasts for rotas and for planning consultation capacity.
Gate · must be true to passEach wave passes the same accuracy and incident checks.
| Activity | Superintendent pharmacist | Operations director | Product owner | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | IG & DPO | SecurityI can fill this |
|---|---|---|---|---|---|---|---|---|
| Business case and benefits | Consulted | Accountable | Responsible | Consulted | Consulted | Informed | Informed | Informed |
| Hub eligibility rules and SOPs | Accountable | Consulted | Responsible | Consulted | Informed | Consulted | Informed | Informed |
| Target architecture | Consulted | Informed | Consulted | Accountable and Responsible | Consulted | Consulted | Consulted | Consulted |
| DPIA, DSPT and hub data sharing | Consulted | Informed | Consulted | Consulted | Informed | Informed | Accountable and Responsible | Consulted |
| Build and dispensing system integration | Informed | Informed | Consulted | Accountable | Responsible | Responsible | Informed | Consulted |
| Forecast and routing accuracy testing | Consulted | Consulted | Accountable | Responsible | Consulted | Responsible | Informed | Informed |
| Go-live decision | Accountable | Responsible | Responsible | Consulted | Responsible | Informed | Consulted | Consulted |
| Run, monitor and improve | Consulted | Consulted | Accountable | Consulted | Consulted | Responsible | Consulted | Consulted |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the forecasts, the routing rules, the integration with your dispensing and hub systems, and the gates. I'd report to your programme board and work closely with the superintendent's office.
Option B
If your partner or your own team already has an architect, I'd take on the forecasting, the owings agent and the dispensing system integration under their lead, and give them a second senior opinion on the rest.
Goes wrong
The forecast looks good across the group, but individual branches are badly wrong.
How the design avoids it
Measure accuracy branch by branch and day by day, and let branch managers add local knowledge.
Goes wrong
A model learns to send items to the hub that should never go there.
How the design avoids it
Eligibility is a set of hard rules owned by the superintendent. The model only chooses among items the rules allow.
Goes wrong
The dispensing system supplier can only give a nightly extract, found out in week six.
How the design avoids it
Confirm data access, latency and cost with the supplier in writing during discovery.
Goes wrong
Errors found at the hub never reach the branch, or the other way round.
How the design avoids it
One shared incident log, item-level traceability, and a weekly joint review.
Goes wrong
Pharmacist time is freed, but goes to more dispensing instead of consultations.
How the design avoids it
Plan the freed hours into the rota as clinical time, and measure consultations, not just items.
Changes already announced or under way that affect this design. More in the UK horizon scan.
Once authorised by a pharmacist, technicians can carry out or supervise preparation, assembly and supply. Base task permissions on who is authorised, not on job titles, so the workflow can follow the new rules without rework.
Legally available from 29 October 2026, with each branch starting once its ICB approves it. Pharmacist prescribers can then prescribe within Pharmacy First and the contraception service. Use the forecasts to plan prescriber hours for consultations, not only dispensing.
NHS England's working date to retire the old EPS interface. Ask your dispensing system supplier when its feed changes, and test the integration against it before it does.
More patients will order and track prescriptions in the NHS App, and pharmacies are to be connected to the Single Patient Record. Ordering patterns will shift, so record the ordering channel in the data and retrain the forecasts when it moves.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.
