Cardiff Oncology, Inc.

Disclosure Controls and Procedures

Our principal executive officer and principal financial officer evaluated the effectiveness of our disclosure controls and procedures as of December 31, 2025. The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended, or the Exchange Act, means controls and other procedures of a company that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the Securities and Exchange Commission’s rules and forms. Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, as appropriate to allow timely decisions regarding required disclosure. Based on that evaluation, our principal executive officer and principal financial officer concluded that our disclosure controls and procedures were effective as of the end of the period covered by this Annual Report on Form 10-K.

Management’s Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting as such term is defined in Exchange Act Rule 13a-15(f). Internal control over financial reporting is a process designed under the supervision and with the participation of our management, including our principal executive officer and principal financial officer, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with accounting principles generally accepted in the United States of America. All internal control systems, no matter how well designed, have inherent limitations. Therefore, even those systems determined to be effective can provide only reasonable assurance with respect to financial statement preparation and presentation.

As of December 31, 2025, under the supervision and with the participation of our management, including our principal executive officer and principal financial officer, we conducted an evaluation of the effectiveness of our internal control over financial reporting based on the framework in Internal Control-Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this assessment, our management concluded that, as of December 31, 2025, our internal control over financial reporting was effective based on those criteria.

Changes in Internal Control Over Financial Reporting

There has been no change in our internal control over financial reporting during the quarter ended December 31, 2025, that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.