The EU now requires that smartphones and tablets receive a minimum of 5 years of security updates - starting from the end of sale.

A product information sheet must be published for each new device, and one of the categories included is how long the device will receive security updates:

e.g. for iPhone 17 Pro:

https://regulatoryinfo.apple.com/cwt/api/ext/file?fileId=ene...