Cardiff Oncology Inc

Evaluation of Disclosure Controls and Procedures

We have performed an evaluation under the supervision and with the participation of our management, including our principal executive officer (CEO) and principal financial officer (CFO), of the effectiveness of our disclosure controls and procedures, as defined in Rule 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Based on that evaluation, our principal executive officer and principal financial officer concluded that our disclosure controls and procedures were effective as of March 31, 2025, to provide reasonable assurance that information required to be disclosed by us in the reports filed or submitted by us under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms.

Our disclosure controls and procedures are designed to provide reasonable assurance of achieving their objectives as specified above. Management does not expect, however, that our disclosure controls and procedures will prevent or detect all errors and fraud. Any control system, no matter how well designed and operated, is based upon certain assumptions and can provide only reasonable, not absolute, assurance that its objectives will be met. Further, no evaluation of controls can provide absolute assurance that misstatements due to error or fraud will not occur or that all control issues and instances of fraud, if any, within our company have been detected.

Changes in Internal Control over Financial Reporting

There was no change in our internal control over financial reporting during the three months ended March 31, 2025, that materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.