CARLSMED, INC.

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the “Exchange Act”)), as of the end of the period covered by this Quarterly Report on Form 10-Q. Based on such evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that these disclosures controls were effective at a reasonable assurance level as of September 30, 2025.

Changes in Internal Control

There have been no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act) during the period covered by this Quarterly Report on Form 10-Q that have materially affected, or are likely to materially affect, our internal control over financial reporting.

Limitations on Effectiveness of Controls and Procedures

Our management team, including our Chief Executive Officer and Chief Financial Officer, believes that our disclosure controls and procedures and internal controls over financial reporting are designed to provide reasonable assurance of achieving their objectives and are effective at the reasonable assurance level. However, the effectiveness of any internal control over financial reporting is subject to inherent limitations, including the exercise of judgment in designing, implementing, operating, and evaluating the controls and procedures, and the inability to completely eliminate all potential for misconduct. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, have been detected. The design of any system of controls is based in part on certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Over time, controls may become inadequate because of changes in conditions or deterioration in the degree of compliance with policies or procedures. Because of the inherent limitations in any cost-effective control system, misstatements due to error or fraud may occur and not be detected.