Xilio Therapeutics Inc

Evaluation of Disclosure Controls and Procedures

We maintain “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act, that are designed to ensure that information required to be disclosed in the reports that we file or submit under the Exchange Act is (1) recorded, processed, summarized and reported, within the time periods specified in the Securities and Exchange Commission’s rules and forms and (2) accumulated and communicated to our management, including our principal executive officer and principal financial officer, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure. Our management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and our management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures.

Our Chief Executive Officer (our principal executive officer) and our Senior Vice President, Finance and Accounting (our principal financial and accounting officer) evaluated the effectiveness of our disclosure controls and procedures as of

December 31, 2023. Based upon such evaluation, our Chief Executive Officer and Senior Vice President, Finance and Accounting have concluded that, as of December 31, 2023, our disclosure controls and procedures were effective at the reasonable assurance level.

Management’s Annual Report on Internal Control over Financial Reporting

Internal control over financial reporting refers to the process designed by, or under the supervision of, our principal executive officer and our principal financial officer, and effected by our Board of Directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of consolidated financial statements for external purposes in accordance with generally accepted accounting principles, and includes those policies and procedures that:

Internal control over financial reporting cannot provide absolute assurance of achieving financial reporting objectives because of its inherent limitations. Internal control over financial reporting is a process that involves human diligence and compliance and is subject to lapses in judgment and breakdowns resulting from human failures. Internal control over financial reporting also can be circumvented by collusion or improper management override. Also, projections of any evaluation of effectiveness of internal control over financial reporting to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with policies or procedures may deteriorate. Because of such limitations, there is a risk that material misstatements may not be prevented or detected on a timely basis by internal control over financial reporting. However, these inherent limitations are known features of the financial reporting process. Therefore, it is possible to design into the process safeguards to reduce, though not eliminate, this risk.

Management is responsible for establishing and maintaining adequate internal control over our financial reporting, as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act. Under the supervision and with the participation of our management, including our principal executive officer and our principal financial officer, we conducted an evaluation of the effectiveness of our internal control over financial reporting. Management has used the framework set forth in the report entitled “Internal Control—Integrated Framework (2013)” published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) to evaluate the effectiveness of our internal control over financial reporting. Based on its evaluation, management has concluded that our internal control over financial reporting was effective as of December 31, 2023.

This Annual Report on Form 10-K does not include an attestation report of our independent registered public accounting firm due to a transition period established by rules of the SEC for “emerging growth companies.”

Changes in Internal Control over Financial Reporting

There were no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) that occurred during the period covered by this Annual Report on Form 10-K that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.