A guide for EU institutions, bodies, offices and agencies

Access to documents under Regulation 1049/2001: the 15-working-day clock, the exceptions, and the confirmatory stage

What the Regulation requires of an access-to-documents unit — registration and the working-day count under Regulation 1182/71, the Article 4 exceptions and the overriding-public-interest test, partial access, third-party consultation, the register, the Article 17 report, and what happens when the applicant goes to the Ombudsman or the General Court.

By Steve Goodyear, founder of Realizer Services Published September 4, 2026

Regulation (EC) No 1049/2001 is short — nineteen articles, applicable since 3 December 2001 — and everything difficult about it lives in a handful of provisions: a 15-working-day clock that starts on registration rather than receipt, an exception catalogue split between grounds that carry a public-interest test and grounds that do not, a two-stage procedure in which the confirmatory decision is the one that gets reviewed, and a Court that has spent two decades saying a refusal must rest on a risk that is “reasonably foreseeable and not purely hypothetical.” The Commission alone handled 6,938 initial applications and 641 confirmatory applications in 2024. At that volume the Regulation is an operations problem before it is a legal one. Citations below link to EUR-Lex and the institutions’ own reports; this is general information, not legal advice.

The ground rules: who may ask, and for what

The right sits above the Regulation. Article 15(3) TFEU gives any citizen of the Union, and any natural or legal person residing or registered in a Member State, a right of access to documents of the Union’s institutions, bodies, offices and agencies, whatever their medium; Article 42 of the Charter repeats it, and Article 15(3) requires each institution, body, office and agency to lay down access provisions in its own rules of procedure. Regulation (EC) No 1049/2001 itself was written for the Parliament, the Council and the Commission.

Article 2(3) applies it to all documents held by an institution, “that is to say, documents drawn up or received by it and in its possession, in all areas of activity,” and Article 3(a) defines a document as any content whatever its medium concerning a matter within the institution’s sphere of responsibility. Applications are informal by design: Article 6(1) requires only writing, one of the Treaty languages, and enough precision “to enable the institution to identify the document,” and the applicant need not state reasons. Article 6(2) obliges the institution to help clarify an imprecise application, and Article 6(3) lets it confer informally with an applicant seeking a very long document or a very large number of documents “with a view to finding a fair solution.”

The 15-working-day clock (Article 7)

Article 7(1) contains four obligations in sequence. The application must be handled promptly. An acknowledgement of receipt must be sent. Within 15 working days from registration, the institution must either grant access and provide it in accordance with Article 10 within that period, or state in writing the reasons for total or partial refusal. And a refusal must inform the applicant of the right to make a confirmatory application. Two details trip units up: the clock runs from registration, so the registration step is itself part of the compliance record; and the “grant” limb requires that access is actually provided within the period, not merely promised.

Article 7(3) allows one extension of 15 working days “in exceptional cases, for example in the event of an application relating to a very long document or to a very large number of documents,” on two conditions: the applicant is notified in advance and detailed reasons are given. A standard sentence pasted into a letter on day 15 is neither. Article 7(4) closes the loop: failure to reply within the time limit entitles the applicant to go straight to a confirmatory application.

Counting working days for the institutions

“Working days” in an EU act is a defined term. Regulation (EEC, Euratom) No 1182/71 sets the rules for periods, dates and time limits, and three of them decide every Article 7 and Article 8 deadline:

Article 2(2): working days are “all days other than public holidays, Sundays and Saturdays.”
Article 2(1): public holidays are “all days designated as such in the Member State or in the Community institution in which action is to be taken,” and the Commission publishes the institutions’ days in the Official Journal.
Article 3(1): where a period runs from an event, the day of the event “shall not be considered as falling within the period.” Registration day is day zero.

For 2026 the Commission’s holidays are fixed by Commission Decision C/2025/4103 of 23 July 2025: 1 and 2 January; Maundy Thursday, Good Friday and Easter Monday (2, 3 and 6 April); 1 May; Ascension Day and the day after (14 and 15 May); Whit Monday (25 May); the Luxembourg national holiday (23 June) for staff in Luxembourg and the Belgian national holiday (21 July) for staff in Brussels; All Souls’ Day (2 November); and six end-of-year days from 24 to 31 December — 17 days in total. A generic Monday-to-Friday calendar therefore gets Easter, Ascension and the end of December wrong: an application registered on Monday 30 March 2026 is due on Thursday 23 April, three days later than a weekends-only count would put it. Other institutions and agencies designate their own closures, and Article 2(1) makes the holidays of “the institution in which action is to be taken” the ones that count.

The confirmatory stage (Article 8)

Under Article 7(2) the applicant has 15 working days from receiving a refusal to make a confirmatory application “asking the institution to reconsider its position.” Article 8(1) then gives the institution 15 working days from registration to grant access or give written reasons, and a refusal at this stage must inform the applicant of the remedies: court proceedings and/or a complaint to the Ombudsman. Article 8(2) allows the same exceptional 15-working-day extension, and Article 8(3) provides that failure to reply “shall be considered as a negative reply” that opens both remedies.

Because the confirmatory decision is the one that gets reviewed, most institutions centralise it. In the Commission, where initial applications are handled on a decentralised basis by each department, the implementing rules annexed to Decision 2001/937/EC delegate the confirmatory decision to the Secretary-General, taken “after agreement of the Legal Service,” and the Commission’s report for 2024 describes a dedicated Secretariat-General unit handling confirmatory applications “to ensure an independent review of the replies given at the initial stage.” The outcomes show why the stage matters: of the documents dealt with at the confirmatory stage in 2024, 17.5% saw the initial refusal fully reversed, 42.2% partially reversed, and 40.2% confirmed. A confirmatory application is, statistically, more likely than not to change the answer.

The exceptions (Article 4)

Article 4 is the whole of the withholding law. Article 4(1) lists grounds on which the institution shall refuse access where disclosure would undermine the public interest as regards public security, defence and military matters, international relations, or the financial, monetary or economic policy of the Union or a Member State, or the privacy and integrity of the individual; there is no overriding-public-interest limb. Article 4(2) lists commercial interests including intellectual property, court proceedings and legal advice, and the purpose of inspections, investigations and audits, each “unless there is an overriding public interest in disclosure.” Article 4(3) protects the institution’s decision-making process — documents for internal use where no decision has been taken, and opinions for internal use even after the decision — only where disclosure would seriously undermine the process, and again subject to an overriding public interest.

The Court of Justice fixed the standard in Sweden and Turco v Council (Joined Cases C-39/05 P and C-52/05 P, 1 July 2008): the risk of the protected interest being undermined “must, in order to be capable of being relied on, be reasonably foreseeable and not purely hypothetical,” and general, abstract assertions do not suffice. Two further paragraphs shape every decision. Article 4(6): “If only parts of the requested document are covered by any of the exceptions, the remaining parts of the document shall be released” — partial access is an obligation, which is why redaction is core infrastructure for this Regulation. Article 4(7): the exceptions apply only while protection is justified by the content, up to 30 years, with the privacy, commercial-interest and sensitive-document exceptions able to run longer. In the Commission’s 2024 report, Article 4(1)(b) — privacy — was invoked for 57.8% of the documents to which an exception was applied at the initial stage.

Personal data in documents

Article 4(1)(b) refers expressly to Union legislation on personal data, which for the institutions is now Regulation (EU) 2018/1725. In Commission v Bavarian Lager (C-28/08 P, 29 June 2010) the Court held that where an access application seeks documents containing personal data the data-protection regulation applies in full: the Commission was right to require the applicant to establish the necessity of transferring the names of meeting participants, and where no “express and legitimate justification or any convincing argument” is provided the institution cannot weigh the competing interests as that regulation requires. The provision today is Article 9(1)(b) of Regulation 2018/1725, and Article 9(3) adds that the institutions “shall reconcile the right to the protection of personal data with the right of access to documents.” The same document is assessed under both regimes, and the two assessments must agree.

Consulting third parties and Member States (Article 4(4) and 4(5))

Article 4(4) requires the institution to consult a third party “with a view to assessing whether an exception in paragraph 1 or 2 is applicable, unless it is clear that the document shall or shall not be disclosed.” The consultation does not stop the Article 7 clock and the third party does not decide. The Commission’s rules give the author no less than five working days to reply, within a period that still lets the Commission meet its own deadline; if there is no answer, the Commission decides under Article 4 “taking into account the legitimate interests of the third party on the basis of the information at its disposal.” Article 4(5) is different in kind: a Member State “may request the institution not to disclose a document originating from that Member State without its prior agreement.” The traffic runs both ways — Parliament’s report for 2024 records 36 Article 4(4) consultations received from other institutions and more than 24 sent — so an institution needs a consultation lane with its own dates, parties and outcomes, including a way to record that the consulted party objected and the institution disclosed anyway.

Registers, direct access and copies (Articles 10 to 12)

Article 11 requires each institution to provide public, electronic access to a register of documents, with references recorded “without delay” and each entry carrying a reference number, the subject matter or a short description, and the date the document was received or drawn up and registered, framed so as not to undermine the Article 4 interests. Article 12 adds that legislative documents should be directly accessible subject to Articles 4 and 9, and policy and strategy documents where possible. Under Article 10 the applicant chooses between consulting on the spot and receiving a copy, including an electronic copy where available; consultation on the spot, copies of fewer than 20 A4 pages, and direct access in electronic form or through the register are free, and beyond that the institution may charge no more than the real cost of producing and sending copies. Sensitive documents — those classified TRÈS SECRET/TOP SECRET, SECRET or CONFIDENTIEL under Article 9 — are handled only by persons entitled to see them and registered or released only with the originator’s consent.

The remedies: Ombudsman and General Court

The European Ombudsman. Under Article 228 TFEU the Ombudsman receives complaints of maladministration in the activities of the Union institutions, bodies, offices and agencies. Article 2(3) of the Ombudsman’s Statute, Regulation (EU, Euratom) 2021/1163, requires a complaint within two years of the facts coming to the complainant’s attention and after “the appropriate administrative approaches” to the institution, which here means the confirmatory stage. Since February 2018 the Ombudsman has run a fast-track procedure for access-to-documents complaints: a decision within five working days on whether to open an inquiry and an indicative 40-working-day target for a decision. Findings are not binding, but a non-compliant institution can be the subject of a special report to Parliament. The Ombudsman’s 2021 review found average handling time cut to a third, with the 40-day target missed in two thirds of cases, partly through slow institutional responses. In 2024 the Ombudsman opened 115 inquiries involving the Commission in which access to documents was the main or a subsidiary issue and found maladministration in 10.

The General Court. An action for annulment lies under Article 263 TFEU and must be brought “within two months of the publication of the measure, or of its notification to the plaintiff”; Article 60 of the Rules of Procedure of the General Court extends procedural time limits “on account of distance by a single period of 10 days.” Annulment does not itself release a document: under Article 266 TFEU the institution “shall be required to take the necessary measures to comply with the judgment,” which in practice means a fresh confirmatory decision. In 2024 the General Court gave 11 judgments and six orders in access cases involving the Commission, dismissing the action in five and partially annulling the decision in four. Under either route the record examined is the confirmatory decision and everything behind it — registration date, acknowledgement, extension notice and reasons, consultations, the document-by-document exception analysis, the partial-access work. If those exist as one coherent record on the day the letter goes out, review is a formality; if they must be reconstructed, it is not.

The annual report (Article 17)

Article 17(1) requires each institution to publish annually a report “including the number of cases in which the institution refused to grant access to documents, the reasons for such refusals and the number of sensitive documents not recorded in the register.” The Commission’s reports calibrate what normal looks like:

2023 (COM(2024) 266): 7,274 initial and 599 confirmatory applications, the latter up more than 43% on 2022; at the initial stage 35.7% of documents released in full, 48.3% in part and 16.0% refused.
2024 (COM(2025) 239): 6,938 initial and 641 confirmatory applications, up 7%; of 19,230 documents requested at the initial stage, 32.4% released in full, 47.5% in part and 20.1% refused.
Parliament, 2024: 22 confirmatory applications and 205 applications for administrative documents, almost double the 2023 figure.

Read as a specification, Article 17 asks for three counts the system should produce as a by-product: refusals, refusals by exception relied on, and sensitive documents kept off the register. An institution that tags every withheld document with its Article 4 ground has the report; one that does not has an annual reconstruction.

A defensible access-to-documents operation

Register every application on the day it arrives, send the acknowledgement, and compute day 15 on the institution’s own holiday calendar under Regulation 1182/71.
Record Article 6(2) clarification and the Article 6(3) “fair solution” as steps, so a narrowed scope is documented rather than remembered.
Use the Article 7(3) extension once, in advance, with reasons specific to the file, kept where the confirmatory reviewer can see them.
Assess exceptions document by document, tag each withheld passage with its Article 4 ground, record the overriding-public-interest reasoning for every Article 4(2) or 4(3) refusal, and default to partial access under Article 4(6).
Run third-party and Member State consultations on their own dates inside the Article 7 period, recording the party’s position and any disclosure over objection.
Name both remedies in every confirmatory refusal, and produce the Article 17 figures from the case data rather than a year-end survey.

Where AccessPoint fits

AccessPoint runs this lifecycle inside the institution’s own Microsoft 365 and Azure tenant, and its EU institutions access pack loads Regulation (EC) No 1049/2001 as the legal-authority spine with the 15-working-day clock, the Article 7(3) extension, the confirmatory stage, the Article 4 exception catalogue and Ombudsman and Court oversight preconfigured, with correspondence templates in English and French.

The clock on the institution’s calendar

Every pack ships a business-day calendar with its statutory holidays, and all due-date math runs on it. A request is received on your local calendar day, the clock starts when the request is activated, and extensions and clock pauses carry the reason configured for the type.

Exceptions cited on the redaction

The Article 4 catalogue is the exemption list. Each redaction cites its provision, find-and-redact and proposed redactions speed the personal-data work, and the close dialog flags any redaction citing no exemption.

Consultations on their own dates

Third-party and inter-institutional consultations run as their own records with parties, positions (no objection, objects in part, objects, no response), notices sent from the composer, and a disposition that can record disclosure over objection.

The confirmatory stage as a linked record

The reconsideration is tracked on its own statutory clock, and the review workflow routes the decision through the reviewers and legal sign-off your rules of procedure require.

Oversight tracking

Ombudsman complaints and Court proceedings are handled in the complaints and appeals module, linked to the request they contest, with allegations, evidence sets, findings and recommendations tracked to closure.

Article 17 from the data

The exemptions-and-exceptions, disposition, extensions and compliance-and-overdue reports are built from the case record, so refusals by ground and on-time performance fall out of the year instead of being reconstructed at the end of it.

The same tenant can run the Regulation 2018/1725 pack beside it, so a document assessed under Article 4(1)(b) and under Article 9 of the data-protection regulation sits on one audit ledger. AccessPoint is distributed through Microsoft AppSource, where it has been reviewed and tested by Microsoft.

Regulation 1049/2001 questions

How long does an EU institution have to answer an application for access to documents?

Under Article 7(1) of Regulation (EC) No 1049/2001, the institution must handle the application promptly, send an acknowledgement of receipt, and within 15 working days from registration either grant access or state in writing the reasons for total or partial refusal and inform the applicant of the right to make a confirmatory application. In exceptional cases, for example a very long document or a very large number of documents, Article 7(3) allows a single extension of 15 working days, provided the applicant is notified in advance and detailed reasons are given.

How are working days counted for the EU institutions?

Regulation (EEC, Euratom) No 1182/71 governs periods and time limits in EU law. Working days are all days other than public holidays, Sundays and Saturdays; public holidays are the days designated as such in the institution in which action is to be taken; and the day of the event that starts the period is not counted. The Commission publishes its list each year in the Official Journal. Its 2026 list (Commission Decision C/2025/4103) has 17 days, including Maundy Thursday, Good Friday, Easter Monday, the day after Ascension Day, All Souls’ Day and six end-of-year days from 24 to 31 December.

What is a confirmatory application?

If access is wholly or partly refused, Article 7(2) gives the applicant 15 working days from receiving the reply to make a confirmatory application asking the institution to reconsider. Under Article 8 the institution then has 15 working days from registration, extendable by 15 in exceptional cases, to grant access or give reasons and tell the applicant about the remedies available: court proceedings and a complaint to the European Ombudsman. Silence at the end of that period counts as a negative reply. In the Commission the decision is taken by the Secretary-General after agreement of the Legal Service.

Which exceptions have a public-interest test and which do not?

Article 4(1) protects the public interest as regards public security, defence and military matters, international relations and financial, monetary or economic policy, and the privacy and integrity of the individual; those grounds have no overriding-public-interest test. Article 4(2) covers commercial interests, court proceedings and legal advice, and the purpose of inspections, investigations and audits, and Article 4(3) covers the institution’s decision-making process; each of those applies unless there is an overriding public interest in disclosure. Under Article 4(6), if only parts of a document are covered by an exception, the remaining parts must be released.

What can an applicant do after a confirmatory refusal?

Two routes. A complaint to the European Ombudsman under Article 228 TFEU, which must be lodged within two years of the complainant becoming aware of the facts and after approaching the institution first; the Ombudsman runs a fast-track procedure for access-to-documents complaints with an indicative target of 40 working days. Or an action for annulment before the General Court under Article 263 TFEU, which must be brought within two months of notification of the decision, extended by a single period of ten days on account of distance under the Court’s Rules of Procedure. Failure to reply within the Article 8 time limit opens both routes.

How many applications do the institutions actually receive?

The Commission’s report for 2024 (COM(2025) 239) records 6,938 initial applications and 641 confirmatory applications, up 7% on 2023. At the initial stage, of 19,230 documents requested, 32.4% were released in full, 47.5% in part and 20.1% refused; at the confirmatory stage 17.5% of documents saw the refusal fully reversed and 42.2% partially. The exception invoked most often at the initial stage was Article 4(1)(b), privacy and the integrity of the individual, cited for 57.8% of documents.

Sources

Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents, OJ L 145, 31.5.2001, p. 43 (Articles 2–12 and 17; accessed September 2026)
Article 15 TFEU, Article 228 TFEU, Article 263 TFEU, Article 266 TFEU and Article 42 of the Charter of Fundamental Rights (accessed September 2026)
Regulation (EEC, Euratom) No 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits (Articles 2 and 3; accessed September 2026)
Commission Decision of 23 July 2025 on public holidays in 2026 for officials and other servants of the European Union serving in Brussels and Luxembourg, C/2025/4103, OJ C, 24.7.2025, and the companion decision for 2027, C/2025/4102
Commission Decision 2001/937/EC, ECSC, Euratom of 5 December 2001 amending its rules of procedure (annex: detailed rules for the application of Regulation (EC) No 1049/2001; accessed September 2026)
Report from the Commission on the application in 2024 of Regulation (EC) No 1049/2001, COM(2025) 239 final, 19.5.2025, and Report on the application in 2023, COM(2024) 266 final, 3.7.2024; index of reports at commission.europa.eu
European Parliament, Public Access to Documents 2024 — annual report (accessed September 2026)
Sweden and Turco v Council, Joined Cases C-39/05 P and C-52/05 P, judgment of 1 July 2008, paragraph 43
Commission v Bavarian Lager, Case C-28/08 P, judgment of 29 June 2010, paragraphs 77–78
Regulation (EU) 2018/1725, Article 9 (transmissions of personal data and reconciliation with access to documents)
Regulation (EU, Euratom) 2021/1163 of the European Parliament of 24 June 2021 laying down the regulations and general conditions governing the performance of the Ombudsman’s duties, Article 2(3)
European Ombudsman — Fast-Track procedure for access to documents complaints and Review of the Ombudsman’s Fast-Track procedure (24 February 2021)
Rules of Procedure of the General Court, Article 60 (extension on account of distance)

Last reviewed: September 2026. This guide is general information for access-to-documents practitioners, not legal advice — rely on the official text of Regulation (EC) No 1049/2001, your institution’s implementing rules and its legal service.