Google has also quietly backed away from the initial software promise of Android One. In Google's first announcement post, the sales pitch read thusly: "To help ensure a consistent experience, Android One devices will receive the latest versions of Android directly from Google. So you’ll get all the latest features, up-to-date security patches, and peace of mind knowing your stuff is always backed up." The take-away from the announcement was that software would work just like with the Nexus program.
In an update to Google's update support page earlier this year, though, the software situation completely flip-flopped. It now reads "Android One phones receive the latest version of Android from Google’s hardware partners. Google’s partners send updates based on their schedule—trying to get them to you as soon as possible." (Emphasis ours.) It seems like existing devices are still supported by Google, given the initial sales pitch and the fact that they got updated on "day two" of Marshmallow's release, but it sounds like future Android One phones will be at the mercy of their OEM when it comes to updates.
Android One devices also aren't part of the new monthly security update program. The support page says that OEMs commit to updates for "at least eighteen months" after the phone’s launch and promises "several smaller security updates" over an 18-month lifespan, but there's nothing about a monthly schedule.
Google’s “Android One” gets watered down again, now a shell of its former self | Ars Technica