XBiotech Inc.

Management's Evaluation of our Disclosure Controls and Procedures

As of the end of the year covered by this Annual Report on Form 10-K, an evaluation was carried out by the Company’s management, with the participation of the Chief Executive Officer and Principal Financial Officer, of the effectiveness of the Company’s disclosure controls and procedures, as defined in Rule 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934. Based on such evaluation, the Chief Executive Officer and Principal Financial Officer concluded that the Company’s disclosure controls and procedures are effective to ensure that information required to be disclosed in the reports the Company files or furnishes under the Securities Exchange Act of 1934 is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and regulations, and are operating in an effective manner.

Management’s Annual Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over the Company’s financial reporting (as defined in Rule 13a-15(f) under the Exchange Act). The Company’s management, with the participation of the Chief Executive Officer and Principal Financial Officer, conducted an assessment of the effectiveness of our internal control over financial reporting based on the criteria set forth in Internal Control – Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (2013 framework). Based on our management’s assessment, we have concluded that our internal control over financial reporting was effective as of December 31, 2025, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with GAAP.

Changes in Internal Control Over Financial Reporting

There was no change in our internal control over financial reporting that occurred during the quarter ended December 31, 2025 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.

Limitations on Effectiveness of Controls and Procedures

In designing and evaluating the disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures must reflect the fact that there are resource constraints, and that management is required to apply judgment in evaluating the benefits of possible controls and procedures relative to their costs.