Published: April 2020 | Last updated: May 2026
The label on a rapid STD test kit usually carries two acronyms that look interchangeable to a shopper but signal very different things to a regulator: ISO 13485 and GMP. One describes how the company that builds the kit is run. The other describes how each individual batch of devices is physically made. Both are audited by outside parties. Neither, on its own, is proof that any specific test result will be correct.
This article translates what those certificates mean in practice for the at-home rapid kits we sell, so a reader can buy with informed trust rather than take a marketing line at face value. We cover what ISO 13485 governs, how a manufacturer earns and keeps the certificate, where GMP fits in, what the standards do and do not say about a 98 to 99 percent accuracy figure, and how to verify any company's claims yourself.
What ISO 13485 governs
ISO 13485 is the international standard for quality management systems specific to medical devices. It is published by the International Organization for Standardization, the body that maintains the ISO 9000 family of management standards. ISO 13485 borrows the structure of ISO 9001 but adds requirements that apply only to medical equipment: formal risk management, traceability of every raw material lot, sterile-product controls, design verification and validation, and post-market surveillance.
The standard is process-based, not product-based. That distinction matters. ISO 13485 does not say a chlamydia rapid test must hit a particular sensitivity number. It says the company making that test must have a documented system for designing it, validating it against requirements, sourcing raw materials from approved suppliers, recording each manufacturing step with a named operator, training staff, calibrating instruments, handling consumer complaints, and recalling defective lots when needed. Every one of those processes has to leave an audit trail that an inspector can follow months or years later.
National regulators reference ISO 13485 inside their own rules. The US Food and Drug Administration accepts ISO 13485 as the framework for the Quality System Regulation, codified as 21 CFR Part 820 and harmonized with ISO 13485 in a final rule that took effect in February 2026 (FDA Quality System Regulation page). The European Union references it in the In Vitro Diagnostic Regulation. The UK MHRA, Health Canada, the TGA in Australia, ANVISA in Brazil, and the PMDA in Japan all reference it. That is why a single ISO 13485 certificate, issued by an accredited body, opens market access on multiple continents without each national regulator demanding a separate factory audit.
What ISO 13485 does not certify is the clinical accuracy of any particular device. Clinical accuracy comes from a separate file: a clinical evaluation report, a documented sensitivity and specificity study, and either an FDA 510(k) clearance, a De Novo authorization, or a CE certificate of conformity. A rapid HIV test sold to consumers in the United States needs both pieces. ISO 13485 covers the factory, and FDA clearance covers the device. A test that has only one of the two is not legally marketable.
ISO 13485 audits the company that makes the test, not the test itself. A separate clinical performance study, summarized in an FDA 510(k) clearance or a CE certificate of conformity, is what verifies how accurately a specific device detects a specific infection. A trustworthy rapid test kit carries both kinds of evidence on file, and a vendor should be able to produce both on request.
How a manufacturer earns and keeps an ISO 13485 certificate
A factory cannot self-certify. ISO 13485 certification requires a third-party audit by an accredited certification body. The auditor reviews documented procedures, observes manufacturing operations, traces a sample of devices from raw material through finished goods, and interviews staff. They flag nonconformities, which the company must close in writing before the certificate is issued.
For a manufacturer planning to sell into multiple regulated markets, the Medical Device Single Audit Program is the most efficient route. MDSAP is a single audit, recognized by the regulators of the United States, Canada, Australia, Brazil, and Japan, that simultaneously covers ISO 13485 plus the country-specific quality system requirements of those five jurisdictions (FDA MDSAP program page). For foreign manufacturers selling into the US market, an MDSAP audit replaces routine FDA inspections as long as the certificate remains current.
The certificate is valid for three years. During that window the certification body conducts at least one surveillance audit per year. Surveillance audits are shorter than the initial audit, but they look at the same processes and they will pull the certificate if material nonconformities surface and are not closed within the agreed timeline. At the end of the three-year cycle the manufacturer requests recertification, which triggers a full audit again.
Two practical signals to look for on a real certificate. First, the name and accreditation number of the certification body. TUV Rheinland, BSI, SGS, Dekra, DNV, and Intertek are the common ones in this product category. Second, the scope of certification. Scope matters because a certificate that reads "design and manufacture of in-vitro diagnostic devices for the detection of infectious agents" is much more specific than a generic "manufacturer of medical devices" wording. The narrower scope is the trustworthy one for a rapid STD test kit.
If a vendor claims ISO 13485 but cannot produce a current certificate showing the right scope, the certificate is either lapsed or never applied to the specific product line.
GMP, Good Manufacturing Practices, explained
GMP is a separate concept from ISO 13485, although the two overlap heavily. GMP is the regulatory term used by the World Health Organization, the US FDA, and most national health authorities for the rules that govern how medicinal products and medical devices are physically manufactured. In the United States the device version is called the Quality System Regulation, codified as 21 CFR Part 820, and as of February 2026 it has been formally harmonized with ISO 13485. In practical terms an ISO 13485 certificate and a US current Good Manufacturing Practices (cGMP) compliant operation now describe essentially the same control set.
What GMP rules require is concrete and physical: validated cleanrooms with monitored air quality, calibrated pipettes and analytical instruments, sealed and identified incoming materials, written batch records signed by named operators, change control on every modification of the product or process, and reserve samples kept from each batch so the manufacturer can retest months later if a problem emerges. GMP also requires a defined complaint-handling pathway, so that if a clinician or a consumer reports a result that does not match a confirmatory laboratory test, that report is logged, investigated, and used to update the manufacturing process if a real defect is identified.
For lateral-flow rapid tests the most consequential GMP controls are the ones that affect the chemistry on the test strip: the consistency of the gold-conjugate solution from lot to lot, the precision of the antibody striping pattern, the humidity of the assembly line during membrane drying, and the temperature at which finished strips are stored before packaging. A failure in any of these steps produces strips that look identical to good ones but read differently from sample to sample, which is precisely the failure mode a routine GMP inspection is designed to surface before lots ship.
The WHO maintains the international reference set of GMP guidelines used by national regulators worldwide (WHO Health Product Policy and Standards).
A real ISO 13485 certificate names the manufacturer, the certification body and its accreditation number, the certificate number, the scope statement (look for in-vitro diagnostic wording), and the issue and expiry dates. If any of those fields is missing or unreadable, treat the claim as unverified until the vendor produces a complete PDF.
TUV Rheinland and the role of accredited notified bodies
Technischer Uberwachungsverein Rheinland, abbreviated TUV Rheinland, is a German testing, inspection, and certification company that audits manufacturers across many industries. In the medical device world TUV Rheinland is one of a handful of bodies recognized as a notified body under EU IVDR, as a Recognized Auditing Organization under MDSAP, and as an accredited ISO 13485 certifier. When a rapid test kit carries the TUV Rheinland mark plus a certificate number, that number can be looked up on TUV Rheinland's public Certipedia database via the company's main site at tuv.com.
A notified body's role is independence. ISO 13485 itself is just a document. What makes the certificate meaningful is that the entity confirming compliance has no financial relationship with the manufacturer beyond the audit fee, has its own accreditation reviewed by national accreditation bodies, and stakes its reputation on the audits it signs. Other commonly seen names in this space are BSI Group, SGS, DNV, Dekra, and Intertek. Any of these names on a certificate is reasonable evidence of a real audit. A certificate with no notified body name, or only the manufacturer's own logo, is not.
For verification across all of these bodies, the global IAF CertSearch registry at iafcertsearch.org lets a buyer cross-check any IAF-recognized management system certificate, regardless of which body issued it.
What 98 to 99 percent accuracy means in practice
The marketing copy for many rapid STD tests, including some on this site, quotes a 98 to 99 percent accuracy figure. The word accuracy by itself is imprecise, and ISO 13485 and GMP do not themselves verify any clinical number. What they do is make sure the underlying clinical performance study was conducted under a controlled process and that the production line continues to make the same device that was studied. The numbers themselves come from that performance study.
Two distinct measurements are usually collapsed into the word accuracy:
- Sensitivity is the percentage of truly infected samples that the test correctly identifies as positive. A test with 99 percent sensitivity will miss roughly 1 positive specimen in 100.
- Specificity is the percentage of truly uninfected samples that the test correctly identifies as negative. A test with 99 percent specificity will produce roughly 1 false positive per 100 uninfected specimens.
For the lateral-flow rapid tests we sell, sensitivity and specificity vary by analyte, by sample type, and crucially by how long after exposure the test is run. Antibody-based blood tests (HIV, syphilis, both herpes simplex panels, both hepatitis panels) hit their peak sensitivity only after the body has produced detectable antibody, which takes weeks to months depending on the infection. Swab-based antigen tests (chlamydia, gonorrhea, trichomoniasis, HPV) reach reliable sensitivity earlier, usually within days to weeks of symptomatic infection, and they perform best on a properly collected specimen.
Lateral-flow rapid tests use a different chemistry than nucleic acid amplification testing. NAAT, the technology used in centralized clinical laboratories, has higher analytical sensitivity than any lateral-flow chemistry. Comparing the two head-to-head is unfair to lateral-flow and misleading to a buyer. The two technologies are complementary: rapid lateral-flow gives a fast at-home screen, and lab NAAT confirms the result whenever a positive screen or a stubbornly symptomatic negative warrants clinical follow-up.
When a manufacturer publishes a 98 to 99 percent figure, the responsible interpretation is that under the validated specimen collection method, and within the validated post-exposure window for that analyte, this is the agreement with a reference laboratory assay. The figure does not transfer to specimens collected outside that window, or to anatomical sites not covered by the kit.
Good manufacturing practice is that part of quality assurance which ensures that products are consistently produced and controlled to the quality standards appropriate to their intended use.
How to verify any manufacturer's claims
Four checks, in order of effort.
The certificate itself. Ask for the ISO 13485 certificate as a PDF. Real certificates list the manufacturer's legal name, the issuing notified body's name and accreditation number, the certificate number, the scope statement, and the issue and expiry dates. If any of those fields is missing, treat the claim as unverified.
The notified body database. Most certification bodies maintain a public lookup. TUV Rheinland publishes Certipedia, BSI publishes its directory of clients, and the global IAF CertSearch tool at iafcertsearch.org covers IAF-recognized certificates across every issuing body. Entering the certificate number returns the current status, including any suspensions. A certificate that does not appear in any registry was either suspended or fabricated.
The product registration. For markets that require it, a separately registered product file exists: an FDA 510(k) summary searchable on the FDA's 510(k) Premarket Notification database, a CE certificate of conformity issued by a notified body, or a national registration on the relevant regulator's site. The product registration is the document that contains the sensitivity and specificity numbers, not the ISO certificate.
The complaint history. The FDA's MAUDE database (MAUDE adverse event reporting) is searchable for adverse event reports tied to a specific device or manufacturer. A long-standing product with zero entries is reassuring. A pattern of complaints about a specific failure mode is a signal worth weighing.
If a vendor declines to share the certificate PDF, or the certificate number does not appear in any public registry, treat the claim as unverified and shop elsewhere.
| Certification or Mark | What it covers | Audited by | Renewal cycle |
|---|---|---|---|
| ISO 13485 | Quality management system for medical device design and manufacture | Accredited certification body (TUV, BSI, DNV, SGS, Dekra, Intertek) | 3 years, annual surveillance audits in between |
| GMP / 21 CFR Part 820 | Physical manufacturing conditions, batch controls, complaint handling | FDA (US) or competent authority in other jurisdictions | Ongoing, inspected on routine cycle |
| MDSAP | Combined ISO 13485 audit recognized by 5 regulators (US, CA, AU, BR, JP) | Recognized MDSAP auditing organization | 3 years |
| CE Mark (IVDR) | Conformity and clinical performance for sale in the EU | Notified body designated under IVDR | 5 years for Class B and C devices |
| FDA 510(k) | Substantial equivalence of a device to a cleared predicate | FDA review | Single clearance, valid until device design changes |
What this means when you buy an at-home rapid test
The reason these certifications matter to a buyer is not the logo. It is the system the logo signals.
When a rapid test kit reaches your front door after passing an ISO 13485-certified manufacturing process, audited under MDSAP, then a separate GMP-controlled production line, then a serialized lot release with reserve samples held back, you are buying the same chemistry that went into the clinical validation study. The strip you handle is built to the same specifications as the strip the reference laboratory ran. That equivalence is the whole point of a quality management system.
When a kit reaches your door without those controls, the chemistry on your strip may or may not match the validation. The strip may have spent six weeks on a hot warehouse shelf, or been assembled with a slightly different lot of conjugate, or stored in humidity that crept above the validated range. Visually it looks the same; functionally it may read inconsistently.
This is why the certifications are worth more than a marketing line. They give a buyer a way to inspect the production process without standing on the factory floor.
Clinical judgment remains essential regardless of which certifications the manufacturer holds. Persistent symptoms after a negative rapid test call for a clinical evaluation; a positive result calls for confirmatory lab testing at a clinic. Rapid tests are screening tools designed to direct the next decision. The certifications make those screening results reliable enough to act on; they keep rapid tests in their proper role as a first step rather than a substitute for laboratory medicine.
One last buying note. Combination kits multiply the value of these certifications: each additional analyte in a combination kit lowers the cost per test, and the same ISO 13485 and GMP audit covers every strip in the box.
FAQs
- Is ISO 13485 the same as ISO 9001?
- No. ISO 9001 is the general quality management standard used by any industry. ISO 13485 is built on the same backbone but adds requirements specific to medical devices, including risk management, design controls, sterile-product handling, traceability of materials, and post-market surveillance. A medical device manufacturer needs ISO 13485 specifically. ISO 9001 on its own is not enough for regulated device sales.
- Does ISO 13485 mean the test is FDA-cleared?
- No. ISO 13485 certifies the quality system of the manufacturer. FDA clearance is a separate process that reviews the clinical performance of a specific device. A rapid test sold in the United States needs both: ISO 13485 for the factory, plus FDA clearance (a 510(k) or De Novo authorization) for the device itself. The ISO certificate and the FDA clearance are different documents from different bodies.
- How can I check that a manufacturer's ISO 13485 certificate is real?
- Start at iafcertsearch.org and enter the certificate number. The IAF registry covers every accredited issuing body in one place, so a real certificate appears within seconds and a withdrawn one shows up as suspended or expired. If the vendor will not give you a certificate number to look up, treat that refusal itself as the answer.
- What does GMP add on top of ISO 13485?
- ISO 13485 is the system blueprint; GMP is what keeps that blueprint in practice on the production floor. The cleanroom air has to meet spec, the conjugate solution has to match its certificate of analysis from lot to lot, operators have to sign each batch record, and reserve samples have to be held for retesting. Without those controls in place, an ISO certificate describes a process that may not be running as written. With them, every strip in a lot performs the way the validation study said it would.
- Does 98 to 99 percent accuracy mean the test will be right 99 times out of 100 for me?
- Not quite. The figure is an agreement rate measured against a laboratory reference test under controlled conditions: a validated specimen, collected correctly, run within the validated post-exposure window for that particular infection. Used outside those conditions (a swab from the wrong anatomic site, an antibody blood test taken too early after exposure), the real-world accuracy for you can fall below the headline number. Always check the kit's instructions for the recommended testing window.
- What is TUV Rheinland and why does the name appear on the box?
- TUV Rheinland is one of a small number of internationally accredited certification bodies recognized to audit medical device manufacturers under ISO 13485 and the EU IVDR. The name on the box signals that an independent auditor confirmed the manufacturing system. A certificate number printed alongside the name can be verified on TUV Rheinland's public Certipedia database at tuv.com.
- Are at-home rapid tests as accurate as lab tests?
- They use different technology. Rapid lateral-flow tests are designed for screening with a fast at-home result. Clinical laboratories use NAAT (nucleic acid amplification testing), which has higher analytical sensitivity for most STIs. The two are complementary. A positive rapid test should be confirmed with a clinical NAAT. A negative rapid test in a person with symptoms should still trigger a clinical visit, since lateral-flow has lower sensitivity than lab testing in early or low-burden infections.
- Do the same standards apply to swab tests and fingerstick blood tests?
- Yes. ISO 13485 and GMP requirements are technology-neutral. Whether the device is a lateral-flow blood test or a lateral-flow swab test, the same quality system audits the design, the materials, the manufacturing process, and the post-market surveillance. The clinical performance studies behind each device type are separate, since the chemistry and sample type differ, but the manufacturing controls are the same standard.
- International Organization for Standardization. ISO 13485: Medical devices, quality management systems requirements for regulatory purposes. Overview of the standard and its scope.
- US Food and Drug Administration. Medical Device Single Audit Program (MDSAP) overview, recognized auditing organizations, and program scope.
- US Food and Drug Administration. Quality System Regulation / Medical Device Current Good Manufacturing Practices, including the 2024 final rule harmonizing 21 CFR Part 820 with ISO 13485 (effective February 2026).
- World Health Organization. Health Product Policy and Standards, including Good Manufacturing Practices guidance for medicines and in-vitro diagnostics.
- IAF CertSearch. Global registry of accredited management system certificates, used to cross-check ISO 13485 certificates across every IAF-recognized issuing body, including TUV Rheinland, BSI, SGS, DNV, Dekra, and Intertek.
- US Food and Drug Administration. 510(k) Premarket Notification database, used to confirm clinical clearance of a specific in-vitro diagnostic device.
