I think it depends on sector and the size of your organisation.
As far as I understand, a small organisation with a simple webshop would normally not fall in scope.
But in that case, I guess customers who are in scope may start asking you questions about your (cyber)security.