It's ... very complicated. In most situations, as long as the transaction has a reasonable fee attached to it, you can proceed immediately (this is called a 0-conf transaction), as you can be pretty sure that it will be confirmed eventually. Of course, there are some transaction malleability edge cases that allow double-spends that are fixed with a new feature called segwit that hasn't rolled out yet, so if you are dealing with a potentially malicious party then 0-conf isn't good enough.

In theory, you should wait for a transaction to have at least six confirmations on it before truly trusting it. That has always taken an average of an hour from the transaction first going into a block. It's the "first going into a block" part that takes longer now, unless you attach a higher fee to ensure that it goes in quickly.