The Complete 2026 Compliance Form Guide for Thai Cannabis Dispensaries (PT 33, PT 27/28/29, GACP)

If you’re still operating a cannabis dispensary in Thailand in April 2026, you’ve already survived the reset. Roughly 7,200 shops closed between June 2025 and February 2026 after failing to renew under stricter rules. The country went from about 18,400 dispensaries down to around 11,100. The ones still open are running on a tighter, more documented model — and the compliance work is real.

This guide is for shop owners, managers, and compliance officers. We’ll cover the four official forms you have to handle (PT 33, PT 27, PT 28, PT 29), the GACP sourcing requirement, the new on-site practitioner rule, the penalties, and a practical look at what to verify on every PT 33 at the counter.

The 2026 reset, briefly

The June 26, 2025 Notification on Controlled Herbs (Cannabis) returned cannabis to medical-only status. The Department of Thai Traditional and Alternative Medicine (DTAM) issued the framework that has been enforced since: every sale must be tied to a valid PT 33, every dispensary must source from a GACP-certified grower, every dispensary must self-report monthly, and every dispensary must have a certified practitioner on-site.

The first six months were the shake-out. Most of the 7,200 shops that closed didn’t fail because they couldn’t sell — they failed because they couldn’t (or wouldn’t) document what they sold and where it came from. The compliance burden is the moat.

The on-site practitioner rule (effective January 2026)

As of January 2026, every operating cannabis dispensary in Thailand must have a certified medical or Thai traditional medicine practitioner physically on-site during business hours. The practitioner must hold a current DTAM cannabis-medicine training certificate (minimum 10 hours).

Practically this means hiring (or contracting) one of:

• Medical Doctor
• Thai Traditional Medicine Practitioner
• Applied Thai Traditional Medicine Practitioner
• Pharmacist
• Dentist (less common in dispensary settings)
• Traditional Chinese Medicine Practitioner
• Folk Healer with DTAM certification

Smaller shops sometimes share a practitioner across two or three locations on a rotation, but the rule is that the practitioner is present whenever the shop is open for cannabis sales. Inspectors do walk in unannounced and check.

This is the biggest cost change for small dispensaries. Budget accordingly.

Verifying a customer’s PT 33 at the counter

The PT 33 (พ.ท. 33) is the patient’s prescription. Every sale of cannabis flower (and most edibles, oils, and pre-rolls) must be tied to a valid PT 33 in the customer’s name. The DTAM digital registry lets you confirm the prescription is real before you ring it up.

What to check on every PT 33

A practical counter checklist for staff:

1. Prescriber license number — visible on the form, must match the registered DTAM practitioner database
2. Prescriber signature and stamp — present and matches the license info
3. Patient name — exactly matches the photo ID being presented
4. Patient nationality and ID/passport number — matches the document
5. Patient age 20 or older — verify against ID
6. Diagnosis — must be a DTAM-recognized qualifying condition
7. Daily dosage and duration — calculate and confirm the total grams; never exceed it
8. Date issued — within the last 30 days
9. Dispensary name — must match yours; PT 33s are single-dispensary
10. Patient signature — present
11. Digital registry status — confirm via the DTAM portal that the prescription is active and not already fulfilled

A well-run dispensary completes the registry check before scoping out the order. If the form is forged or expired, the customer leaves with no purchase.

Required customer documentation

Beyond the PT 33, the customer must present:

• Government-issued photo ID (Thai ID or foreign passport)
• A medical certificate detailing the condition (often issued together with the PT 33)
• Proof of being 20 or older

You photocopy or scan the PT 33 and retain it for at least one year for inspection by DTAM or police.

Monthly self-reporting: PT 27, 28, 29

Beyond every-sale documentation, every dispensary submits three monthly forms to DTAM. They’re filed via the DTAM herb control portal at herbctrl.dtam.moph.go.th.

• PT 27 (พ.ท. 27) — monthly declaration of cannabis purchases from GACP-certified growers
• PT 28 (พ.ท. 28) — monthly declaration of cannabis flower processing and transformation (drying, trimming, pre-rolling, packaging)
• PT 29 (พ.ท. 29) — monthly declaration of cannabis flower sales to PT 33-holding patients

The three forms together create a closed loop: PT 27 documents what came in, PT 28 documents what was processed in-house, PT 29 documents what went out. DTAM cross-checks them against grower records (GACP certificates) and patient records (the PT 33 registry). If your PT 29 sales exceed your PT 27 purchases, that’s a red flag for a back-channel source. If your purchase data doesn’t match the grower’s records, both you and the grower get penalized.

The four-form summary

Late or missing monthly submissions are themselves an offense. Don’t skip a month.

GACP: where your cannabis must come from

Every gram of cannabis flower you sell must originate from a GACP-certified grower. GACP (Good Agricultural and Collection Practices) certification is issued by DTAM only — third-party certifications, foreign GACP equivalents, and informal “we follow GACP standards” claims are not accepted.

Key facts:

• DTAM-issued GACP certificate, valid for 3 years
• Application and approval timeline: typically 90–180 days
• The grower’s name and certificate number must appear on every PT 27 you submit
• DTAM cross-checks: if your PT 27 lists a grower whose certificate has expired or is forged, both parties are penalized
• Audits do happen, especially after compliance incidents elsewhere in the supply chain

Practically, this means you maintain an active list of GACP-certified suppliers, you keep their certificate copies on file, and you don’t take a “good deal” from an unverified source. The temptation to source cheap flower from an unlicensed farm is exactly the trap that closed thousands of shops in 2025.

Penalties for non-compliance

The 2025 framework attaches real consequences to record-keeping failures:

The pattern is consistent: a single violation usually costs you a fine. A pattern of violations costs you the business.

What a clean compliance day looks like

For an operator running it correctly, the daily and monthly rhythm goes:

Every day

1. Practitioner is on-site during open hours.
2. Every customer’s PT 33 is verified in the digital registry, photocopied, and filed.
3. Every sale records strain, weight, batch, supplier, buyer, prescription number, and staff member.

Every week

1. Reconcile your in-house inventory against the day’s sales (POS reports vs physical stock).
2. Review supplier deliveries against your stored GACP certificates.

Every month

1. Generate PT 27 from your purchase records.
2. Generate PT 28 from your in-house processing log.
3. Generate PT 29 from your sales records.
4. Submit all three via the DTAM herbctrl portal before the deadline.
5. Cross-check the totals: PT 29 outflow should not exceed PT 27 inflow minus inventory delta.

Every year

1. Confirm every supplier’s GACP certificate is current.
2. Audit your filed PT 33 copies for the last 12 months.
3. Renew your dispensary license.

If those numbers don’t tie out, the question to answer is “where is the gap?” before DTAM asks it.

How modern POS software makes the monthly reports trivial

This is the part most operators don’t realize until they’re three months in: the monthly PT 27/28/29 forms are only painful if you’re reconstructing them from scattered spreadsheets and paper receipts at month-end. If your point-of-sale captures the right fields on every transaction, the monthly forms are a CSV export and a 30-minute review.

A POS built for cannabis (rather than retrofitted from a generic SKU-and-cash setup) records, on every sale automatically:

• The strain (with THC, CBD, terpene profile, batch ID)
• The exact weight from the connected Bluetooth scale
• The supplier and the GACP certificate reference for the batch
• The buyer’s PT 33 number, their name, ID number, and prescription details
• The staff member who handled the sale
• The timestamp and the device

The PT 29 monthly export becomes a query, not a reconstruction. PT 27 imports are tied to your purchase orders against verified suppliers. PT 28 in-house processing is logged at the moment the batch is split, dried, or packaged.

We built Budy POS around this workflow because the alternative — using a generic POS and rebuilding the records by hand each month — is what’s putting shops out of business. If you want to see how it captures every field a PT 27/28/29 needs, the Budy POS for Thai cannabis dispensaries post walks through the practical setup, and the Bluetooth scale integration and AI Smart Scanner pages cover two of the workflows that feed the records.

The point is not which POS you use. The point is: capture the right data at the moment of sale, and the monthly forms write themselves. Capture it later, and you’re fighting a losing battle.

The bottom line

The dispensary count dropped 40% in eight months. The shops that survived the reset did so because they took the documentation seriously — practitioner on-site, PT 33 verified on every sale, GACP-only sourcing, monthly forms filed on time. That’s the bar now. It’s not optional and it’s not going to relax.

If you’re already running clean, this article is a checklist refresher. If you’re still reconstructing monthly reports from receipts, the gap between you and the next inspection is the work this guide describes.

Customers and patients trying to navigate the rules from their side can read our companion piece on cannabis in Thailand 2026: the complete legal guide. To talk through how Budy POS captures the data your PT 27/28/29 reports need, email support@budy.app and we’ll set up a walkthrough on your counter.

This article is informational. For your dispensary’s specific licensing situation, consult DTAM directly or a licensed regulatory advisor.