This is according to a report by The Verge, which referenced confidential contracts from Google.
Google's contract stated that companies must provide "at least four security updates" within one year of the phone's launch, said The Verge.
"Security updates are mandated within the second year as well, though without a specified minimum number of releases."
The contract covers any phone launched after January 2018 that has been "activated by more than 100,000 users".
The move will be welcomed by Android smartphone owners, many of whom do not receive regular updates for devices which are either a couple years old or did not sell well in the market.
