X4 Pharmaceuticals, Inc

Evaluation of Disclosure Controls and Procedures

We maintain “disclosure controls and procedures” as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act, that are designed to ensure that information required to be disclosed in the reports we file and submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by us in the reports we file or submit under the Exchange Act is accumulated and communicated to our management, including our principal executive officer and principal financial officer, as appropriate to allow timely decisions regarding required disclosure. In designing and evaluating our disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives, and management necessarily applies its judgment in evaluating the benefits of possible controls and procedures relative to their costs.

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, who serve as our principal executive officer and principal financial officer, respectively, has evaluated the effectiveness of our disclosure controls and procedures as of December 31, 2024. Based on such evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that our disclosure controls and procedures were effective at the reasonable assurance level.

Management’s Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting for the company. Internal control over financial reporting is defined in Rules 13a-15(f) and 15d-15(f) promulgated under the Exchange Act as a process designed by, or under the supervision of, the company’s principal executive and principal financial officers and effected by the company’s board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that:

•pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the company;

•provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and

•provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Management conducted an assessment of our internal controls over financial reporting based on the framework established by the Committee of Sponsoring Organizations of the Treadway Commission in Internal Control-Integrated Framework (2013). These criteria are in the areas of control environment, risk assessment, control activities, information and communication, and monitoring. Management’s assessment included extensive documentation, evaluating and testing the design and operating effectiveness of its internal controls over financial reporting. Based on the assessment, management concluded that, as of December 31, 2024, our internal control over financial reporting was effective.

Attestation Report of the Registered Public Accounting Firm

This Annual Report does not include an attestation report of our registered public accounting firm regarding internal control over financial reporting due to an exemption established by the JOBS Act for non-accelerated filers.

Changes in Internal Control over Financial Reporting

There have been no significant changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the quarter ended December 31, 2024 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.