Issuance follows the mark certificate guidelines published through the BIMI Group: the CA verifies the organization (much like EV validation) and that the logo is a trademark registered with a recognized office. The logo is embedded in the certificate through the logotype extension of RFC 3709 as a gzipped SVG data: URI, the certificate carries the BIMI EKU 1.3.6.1.5.5.7.3.31 and the domain appears in subjectAltName.
A Common Mark Certificate (CMC) is a lighter alternative accepted by Gmail for logos without a registered trademark that have been displayed publicly for at least a year; it gives the logo but not Gmail's verified check mark. The BIMI and VMC decoder extracts and checks the embedded logo and the chain.