What BIMI is for
BIMI puts your logo next to your messages in supporting inboxes. It is the visible reward for having authentication in order, and that is the honest framing: the logo is the incentive, the authentication is the point.
Gmail, Yahoo, Apple Mail and Fastmail display BIMI logos, with different requirements. Nobody displays one for a domain that is not at DMARC enforcement, which makes BIMI a reasonable finish line for an authentication project and a poor place to start one.
The three things that have to be true
First, DMARC at p=quarantine or p=reject on the domain doing the sending. Not p=none, and not enforcement on the parent while the sending subdomain sits at none.
Second, an SVG that conforms to SVG Tiny Portable/Secure. This is a restricted profile: the root element has to declare baseProfile="tiny-ps", there has to be a <title>, and scripts, links, embedded images and anything loaded from another URL are all forbidden. An export from your design tool will be rejected even though it looks identical, which is what the file check above is for.
Third, for most of your recipients, a certificate. Gmail needs a VMC or a CMC, and Apple Mail needs a VMC specifically. Yahoo and Fastmail will show your logo without one.
VMC and CMC
A Verified Mark Certificate proves you own a registered trademark on the logo. It is issued by a small number of certificate authorities, it is renewed annually, and the trademark requirement is the real barrier rather than the price.
A Common Mark Certificate is Gmail newer alternative for logos with no trademark, requiring instead that the logo has been publicly in use on your domain for at least twelve months. Gmail shows CMC logos without the blue verification tick. Apple Mail does not currently accept CMCs at all.
Without either, your BIMI record is not wasted, it is just limited to the providers that do not ask.
Is BIMI worth it for cold outreach?
Not on its own, and not first. BIMI changes how a message looks once it has already reached the inbox, so it does nothing for the problem cold email usually has, which is arriving at all.
The path there is worth taking anyway, because it runs through SPF, DKIM and DMARC at enforcement, and those three do decide whether you arrive. Treat the logo as the receipt.