BOISE CASCADE Co

Evaluation of Disclosure Controls and Procedures

We maintain "disclosure controls and procedures," as defined in Rule 13a-15(e) under the Exchange Act. We have designed these controls and procedures to reasonably assure that information required to be disclosed in our reports filed or submitted under the Exchange Act, is recorded, processed, summarized, and reported within the time periods specified in the Securities and Exchange Commission's rules and forms. We have also designed our disclosure controls to provide reasonable assurance that such information is accumulated and communicated to our senior management, including our chief executive officer (CEO) and our chief financial officer (CFO), as appropriate, to allow them to make timely decisions regarding our required disclosures. Based on their evaluation, our CEO and CFO have concluded that as of December 31, 2025, our disclosure controls and procedures were effective.

Limitations on the Effectiveness of Controls and Procedures

In designing and evaluating our disclosure and/or internal controls and procedures, we recognized that no matter how well conceived and well operated, a control system can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Because of its inherent limitations, a control system, no matter how well designed, may not prevent or detect misstatements due to error or fraud. Additionally, in designing a control system, our management necessarily was required to apply its judgment in evaluating the cost-benefit relationship of possible controls and procedures. We have also designed our disclosure and internal controls and procedures based in part upon assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions.

Management's Report on Internal Control Over Financial Reporting

The management of Boise Cascade Company (Boise Cascade) is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rule 13a-15(f) or 15d-15(f) under the Exchange Act. Our internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with accounting principles generally accepted in the U.S. Internal control over financial reporting includes those policies and procedures that:

•pertain to the maintenance of records that in reasonable detail accurately and fairly reflect our transactions and dispositions of assets;

•provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles;

•provide reasonable assurance that our receipts and expenditures are being made only in accordance with authorizations of our management and directors; and

•provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of our assets that could have a material effect on our consolidated financial statements.

Internal control over financial reporting includes the controls themselves, monitoring and internal auditing practices, and actions taken to correct deficiencies as identified. As of December 31, 2025, management conducted an assessment of the effectiveness of Boise Cascade's internal control over financial reporting based on criteria for effective internal control over financial reporting described in "Internal Control—Integrated Framework"(2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this assessment, management has concluded as of December 31, 2025, our internal control over financial reporting was effective.

The effectiveness of our internal control over financial reporting as of December 31, 2025, has been audited by KPMG LLP, an independent registered public accounting firm, as stated in its report, which is included herein.

Changes in Internal Control Over Financial Reporting

There were no changes in our internal control over financial reporting that occurred during our latest fiscal quarter that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.