Follow best practices and demonstrate that you care goes a long way (that has been demonstrated time and time again in courts throughout the union).
Also it differentiates between what kind of product you are building (see the annexes).
Most of the requirements (look them up) are best software dev practices unless you are in one of the specific "critical" categories of products.
Then, to be honest I don't really care that you are a one person (commercial) shop when my car gets steered off the road because of a preventable security hole.